Investigating Suspicious Process Execution Using Windows Event Logs

Everything in the Windows environment is tied to a Windows process, including attackers’ actions and activities. The running processes in a Windows system may be legitimate processes related to normal Windows and user activities such as system startup, browsing, updates, and so on, or they may be malware processes. As a SOC analyst, incident responder, or threat hunter, it is crucial to learn how to differentiate between legitimate Windows processes and malware processes as well as how to investigate the process attributes.

The objective of this chapter is to teach you what a process is; the relationships between processes; process types; the most common Windows standard processes; the events provided by Microsoft that allow you to track every process execution activity; the most common attacks and techniques that target Windows processes; and how to investigate them.

In this chapter, we’re going...