Investigating Suspicious Process Execution Using Windows Event Logs

Everything in the Windows environment is tied to a Windows process, including attackers’ actions and activities. The running processes in a Windows system may be legitimate processes related to normal Windows and user activities such as system startup, browsing, updates, and so on, or they may be malware processes. As a SOC analyst, incident responder, or threat hunter, it is crucial to learn how to differentiate between legitimate Windows processes and malware processes as well as how to investigate the process attributes.

The objective of this chapter is to teach you what a process is; the relationships between processes; process types; the most common Windows standard processes; the events provided by Microsoft that allow you to track every process execution activity; the most common attacks and techniques that target Windows processes; and how to investigate them.

In this chapter, we’re going...

Introduction to Windows processes

Windows processes are programs running in the background carrying out Windows operations and program or application execution on a Windows operating system. Each process has its own memory space and resources allocated to it. Everything in the Windows environment, such as account login, file access, memory sections, running DLLs, program and application executions, and so on are tied to a process. Windows processes run in memory with their associations, and you can view the running process on a live machine by either using a command-line tool such as the Tasklist tool or by using a GUI tool such as the Task Manager tool. See Figure 5.1:

Figure 5.1 – The Windows Task Manager tool

As you can see in the preceding screenshot, we viewed the running processes on a live Windows operating system by using the Task Manager tool. You can view more columns and customize your view by right-clicking on any column and selecting...

Windows process types

There are many Windows processes; some of them are verified and documented by either Microsoft or its developers, but most of them are not documented. In this section, we will divide Windows processes into two types:

• Standard Windows processes
• Non-standard Windows processes

The standard Windows processes are processes that are developed by Microsoft and exist on Windows platforms for the operating system’s operations such as the boot, login, and services operations. Non-standard processes are processes that are not developed by Microsoft and do not exist by default installation of the Windows platforms. These processes may be legitimate, such as custom in-house software, or they may be malicious, such as malware or other unauthorized programs.

Common standard Windows processes

In this subsection, we will introduce and explain the most common standard Windows processes that run on most Windows platforms in a default installation...

Windows Process Tracking events

After discussing the Windows processes, their relation, and the legitimate attributes of the most common standard Windows processes, you may now be wondering whether we can track the process creation activities using Microsoft Windows events. The answer is yes. Microsoft allows you to track every process creation and termination activity by recording two Event IDs in the security event log file:

• Event ID 4688 records every process creation activity
• Event ID 4689 records every process exit activity

As we will see in the next section, when investigating suspicious Windows process behavior, you will determine that those process tracking events are crucial to any incident responder, SOC analyst, and threat hunter to detect and investigate such anomalies.

Event ID 4688, named A new process has been created., is recorded in the security log file and contains very useful information about the username, process name, process path, and parent...

Investigating suspicious process executions

To better understand and investigate the suspicious process execution activities that will be discussed in this section, we dedicated sufficient space in the previous sections to gaining a comprehensive understanding of Microsoft’s Windows processes and the Windows event logs related to process creation and termination. In this section, we will focus on observing suspicious process attributes such as suspicious process names, suspicious command-line arguments of legit Windows processes, suspicious process paths, and suspicious parent-child process relationships.

We will discuss the following suspicious process execution behaviors and techniques:

• Hiding in plain sight
• Living Off the Land
• Suspicious parent-child process relationships
• Suspicious process paths

Hiding in plain sight

Do you remember the common standard Windows processes discussed earlier in this chapter, in the Standard Windows processes...

Summary

In this chapter, we covered what Windows process means, the relationships between processes, the process types, and the most common Windows standard process. We also explored the events that Microsoft provides, which allow you to track every process execution activity and the most common attacks and techniques that target Windows processes. Armed with this knowledge, you are better equipped to investigate suspicious activities related to process execution.

In the next chapter, we will delve into PowerShell event logs and how to effectively investigate them to uncover malicious activities and threats.