Investigating suspicious process executions

To better understand and investigate the suspicious process execution activities that will be discussed in this section, we dedicated sufficient space in the previous sections to gaining a comprehensive understanding of Microsoft’s Windows processes and the Windows event logs related to process creation and termination. In this section, we will focus on observing suspicious process attributes such as suspicious process names, suspicious command-line arguments of legit Windows processes, suspicious process paths, and suspicious parent-child process relationships.

We will discuss the following suspicious process execution behaviors and techniques:

• Hiding in plain sight
• Living Off the Land
• Suspicious parent-child process relationships
• Suspicious process paths

Hiding in plain sight

Do you remember the common standard Windows processes discussed earlier in this chapter, in the Standard Windows processes...