Lesson 9 of 10 · About 4 minutes
Follow a suspicious process
Learn the concept.
A process tree shows which program started another. Following that relationship helps you turn an unfamiliar alert into a focused investigation.
Follow the parent-child chain
Follow the sequence, or move one step at a time.
Reduced motion is on. Use Next step to explore without animation.
Read all 4 steps
- Start with the opened document
The viewer opens the invoice at 09:41 UTC. This is the first observed process in our simplified chain.
- A child starts
At 09:42, the viewer starts an interpreter. The recorded relationship is the lead to examine.
- Follow the next child
The interpreter starts a downloaded program. Review command details and related events.
- Separate observation from verdict
The user expected only to read an invoice. Escalate according to the playbook; this diagram does not prove a completed theft.
Trace one execution, not just a filename
A fictional training example. Compare the observation with the conclusion.
- 09:41 UTCDocument viewer · P101
User opens an invoice.
- 09:42 UTCCommand interpreter · P102
Recorded parent: P101.
- 09:42 UTCDownloaded program · P103
Recorded parent: P102. Follow related events.
Read the visualA document viewer starts a command interpreter. What is the best next step?
The relationship merits investigation. Context and correlated records help establish what happened.
Start with the parent
Check the recorded parent, child, device, account, and start time. A familiar filename alone cannot tell you whether a program is safe.
Read the surrounding evidence
Review the command line, file location, and related file or network events. Use process identifiers and timestamps to correlate records; a reused process ID can point to a different execution.
Test the explanation
Compare the activity with the user’s expected task and approved automation. Preserve evidence and follow the response playbook before taking disruptive action.
Put it in context
Fictional case: a document viewer starts a command interpreter, which launches a downloaded executable. The user expected only to read an invoice. That mismatch warrants investigation; the tree alone does not establish what the executable did or who supplied it.
Make a decision.
Use what you just learned. A correct answer lets you save this lesson to your progress.
Take this with you.
Follow the relationship, then check the behavior. A process name is a clue, not a verdict.
Next lesson: Spot unusual outbound trafficSee it in a Short.
Optional video companions from MyCyberTutor. Your lesson progress stays here.