Open cardosec

Case 731991 · Blue team / DFIR · L2 Practitioner

Hunting with Process Lineage

Practise as: Explain it · InterviewLevel: L2 Practitioner

Interview questionWhich parent-child process relationships would you hunt for, and why do they work?

  1. 01 What is it?
  2. 02 How is it abused?
  3. 03 How do you stop it?
Practise this card As Interview
What a strong answer covers

Try it out loud first. Then check yourself:

  1. Many techniques need a process to start another one, so the parent-child pair reveals intent even when the binary is legitimate.
  2. Red flags: Office apps spawning script hosts or PowerShell, w3wp.exe or sqlservr.exe spawning cmd.exe, anything spawned by lsass.exe.
  3. Know the normal tree: services.exe starts svchost.exe, a user shell comes from explorer.exe, and wininit.exe starts lsass.exe.
  4. Attackers spoof parents (PPID spoofing) or inject into trusted processes, so pair lineage with command lines, signers and network activity.

If the interviewer pushes back

  • How would you detect PPID spoofing, given that the reported parent is the one the attacker chose?

Go deeper

More Blue team / DFIR cards

All Blue team / DFIR cards →

cardosec draws a security topic and gives you a clock: explain it out loud with no notes, then see what you covered and what you missed. Free during early access.

Reviewed 2026-10-09