Lion Cipher Lab

Read Process Explorer: spot the malicious process by its tree, DLLs, and command line

• Digital Forensics & IR (DFIR)
• Intermediate
• ~40 min
• Free · no account required

Why it matters

When a suspected sample is running in front of you in an isolated sandbox, the fastest way to understand it is not to dump memory or replay a log — it is to look at the live process tree. Process Explorer, Microsoft's free Sysinternals tool, shows every running process arranged under its parent, with the signer of each image verified against Microsoft's certificates, the full command line, the DLLs and handles each process holds, and the network connections it has open. Read correctly, that single screen answers 'which of these thirty processes is the malicious one, and what is it doing?' in…

What you'll learn

• reading the Process Explorer tree top-down: which process legitimately parents svchost, lsass, spoolsv and explorer, so anomalies pop
• using the Verify Image Signatures option and the Company Name column to separate signed Microsoft binaries from unsigned impostors
• reading the Command Line column to catch a process running from %TEMP% or %APPDATA% and a hidden encoded PowerShell launch
• spotting a masquerade by name (svch0st.exe with a zero) and by placement (a lone svchost.exe not parented to services.exe)
• reading an anomalous parent-child chain (WINWORD.EXE -> powershell.exe -> an oddly-named child) as an execution story
• using the lower pane to inspect a suspect's loaded DLLs and handles, and the TCP/IP tab to see its live connections
• confirming a verdict with the Strings and Image tabs of the process Properties dialog
• judgment: when a live view beats a static listing, why a signed binary can still be malicious (LOLBins), and when a snapshot forces you to memory forensics

Steps in this lab

1. What Process Explorer is, and why a LIVE tree is its own kind of evidence
2. Know normal before you hunt evil: the canonical Windows genealogy
3. Turn on the columns that turn a list into an X-ray
4. The evidence: the live process tree from the sandbox
5. Masquerade #1: read the Office -> PowerShell -> impostor chain as a story
6. Masquerade #2: the lone svchost.exe hiding at the bottom
7. Drop into the lower pane: the DLLs and handles a suspect is holding
8. Confirm it: the TCP/IP tab, then the Strings and Image tabs
9. The LOLBin trap: a (Verified) signature is not a clean bill of health
10. WHEN the live view wins, where it blinds you, and how a pro reads it

Open the full interactive lab →