Step 13. Inside Processes and Services — Trace the Lineage of Execution

Level 0 — Understanding Computer Operation and Structure | Difficulty ★★★☆☆ | Estimated time 2–3 hours

Prerequisite: Step 12 complete. We will work in Windows PowerShell. No administrator privileges are needed, and an internet connection is required only for the search step in the mission.

• What you need: a Windows PC, PowerShell.
• Caution: every exercise today is querying and brief execution. A command that terminates a program (Stop-Process) appears once — it closes only the experiment program we just opened ourselves. Carelessly terminating other programs can destroy documents you’re working on, so don’t use it on anything beyond the targets this unit directs you to.

Suppose you open Task Manager and find an unfamiliar program running. A security analyst’s first question is fixed: “Who launched this?” Even a harmless-looking program is suspicious if the entity that launched it is suspicious. The world of processes has family relationships — every process has a parent that launched it, and that parent has a parent of its own. Learning to trace this lineage by number is this section’s topic.

1. Learning Objectives

By the end of this unit, you will be able to:

• Explain what a PID is and why processes are identified by number rather than name
• Query parent PIDs with Get-CimInstance Win32_Process and trace a lineage to its end
• Confirm by direct experiment the rule that “the parent of a program I run is me”
• Distinguish service start types (Automatic/Manual/Disabled) and understand their security meaning
• Interpret a “broken link” (a terminated parent) encountered during tracing as a normal situation, not an error

2. Background Knowledge — Today’s Tools and Concepts

This section’s Tools at a Glance

2-1. PID — A Process’s ID Number

A computer can run many programs with the same name. Open Chrome and dozens of chrome.exe processes appear. How do we tell them apart? Each process is assigned a unique number every time it runs. This is the PID (Process ID).

A PID identifies an active process within its system at a particular time. It can be reused after exit. Include collection time, start time, executable path, and account when correlating records.

2-2. The Process Tree — Everyone Has a Parent

A process does not spring from nothing. It is always launched by another process:

System (the progenitor)
 └─ explorer.exe (desktop manager)
     └─ powershell.exe (the PowerShell I opened)
         └─ mspaint.exe (Paint launched from PowerShell)

This tree structure is called the process tree. When you double-click an icon to open a program, explorer.exe (the process managing the desktop) is actually the one that launches it. So the parent of most normal programs is explorer.exe.

An unexpected parent-child relationship is a clue. Correlate executable paths, command lines, signatures, and timing before classifying the activity.

2-3. Who Is the Ancestor?

Windows startup involves System and several session and service processes. A low PID alone does not establish age or trustworthiness; use creation time and documented process relationships.

2-4. Services Review + Start Types

In Step 5 you learned that a service is “a staff member who resides where users don’t look.” Today we add when they come to work — the start type:

The security connection: if malware registers itself as an “Automatic” service, it revives itself automatically even after reboots. So alongside Step 11’s Run key, the “list of auto-start services” is one of the twin pillars of persistence investigation.

3. Follow Along

Before you begin. PIDs can be reused. Identify the current process and owner before acting. Stop only the disposable process you started for this exercise, never a process chosen merely by a familiar name.

3-1. Checking PIDs

Get-Process | Select-Object Name, Id -First 12

Name                     Id
----                     --
acad                  37372
AdskAccessCore         3076
AdskAccessServiceHost  5764
AdskAccessUIHost      13772
AdskAccessUIHost      21672
AdskAccessUIHost      21708
AdskAccessUIHost      21832
AdskIdentityManager   21440
AdskLicensingAgent     1724
...

Illustrative output. Values, wording, account names, and available fields vary by environment.

How to read the output: the left is the process name; the right (Id) is the PID. Even in this illustrative output, AdskAccessUIHost appears four times under the same name — the number on the right is what tells them apart. And that number changes with every run.

3-2. Seeing the Parent PID Too — This section’s New Command

Get-Process doesn’t show parent information. So we use a deeper counter:

Get-CimInstance Win32_Process | Select-Object Name, ProcessId, ParentProcessId -First 12

Name                ProcessId ParentProcessId
----                --------- ---------------
System Idle Process         0               0
System                      4               0
Secure System             236               4
Registry                  276               4
smss.exe                  936               4
csrss.exe                1324            1116
wininit.exe             1448            1116
csrss.exe                1456            1440
winlogon.exe            1544            1440
services.exe            1564            1448
lsass.exe               1620            1448
...

Illustrative output. Values, wording, account names, and available fields vary by environment.

How to read the output:

• ProcessId — this process’s PID
• ParentProcessId — the PID of the process that launched me

In this illustrative snapshot, compare each ParentProcessId with ProcessId. This is a partial current view; it cannot by itself reconstruct the complete process-creation history.

A parent PID absent from this short list is not proof that the parent exited. The first-twelve selection may exclude it; permissions and timing also limit the snapshot. Query that PID and report any remaining uncertainty.

3-3. Tracing Practice — My PowerShell’s Family Tree

Let’s trace it ourselves. The PID of this very PowerShell window comes out in a single word:

$PID

30916

(The number differs with every run.)

Now view that number’s information and parent:

Get-CimInstance Win32_Process -Filter "ProcessId = $PID" | Select-Object Name, ProcessId, ParentProcessId

Name           ProcessId ParentProcessId
----           --------- ---------------
powershell.exe     30916             7600

Illustrative output. Values, wording, account names, and available fields vary by environment.

Query the returned parent PID and repeat while it remains available. The path can pass through a terminal host, a launcher, or another process; do not assume it must pass through explorer.exe.

3-4. Experiment — Becoming a Parent Myself

This time, let’s become a parent ourselves. From this PowerShell window, launch Paint:

Start-Process mspaint

Paint opens (Start-Process runs it and returns to the prompt immediately). Now verify:

Get-CimInstance Win32_Process -Filter "Name = 'mspaint.exe'" | Select-Object Name, ProcessId, ParentProcessId

Name        ProcessId ParentProcessId
----        --------- ---------------
mspaint.exe     21052           26644

Illustrative output. Values, wording, account names, and available fields vary by environment.

Compare the observed parent PID with $PID in the launching shell. Store applications or launch brokers may introduce another process. Record the actual relationship without forcing it to match the example.

Windows application packaging and launch brokers can change the observed parent. Paint, Notepad, and Calculator versions differ. A different parent alone is not evidence of compromise.

Close only the empty Paint window you opened, using its own Close button. If several Paint windows already existed, identify your test window rather than stopping every process with that name.

# Close only your empty test Paint window using its Close button.

3-5. Viewing the Start-Type Distribution of Services

Get-Service | Group-Object StartType | Select-Object Name, Count

Name      Count
----      -----
Manual      195
Automatic   105
Disabled     10

Illustrative output. Values, wording, account names, and available fields vary by environment.

New command — Group-Object: “bundle the same values together.” We grouped by start type and counted.

Automatic is a configured start type, not proof that 105 services are currently running. Dependencies, failures, delayed start, and policy affect actual execution.

This section’s wrap-up — why is this security-relevant?: malware analysis reports have a stock sentence: “The process’s parent was X, and it was registered to auto-start via the Y service.” Today you personally performed both ingredients of that sentence — parent tracing and auto-start verification.

4. Missions & Exercises

Mission — Building a Lineage Trace Card

1. Launch Paint from PowerShell: Start-Process mspaint
2. Check the Paint process’s PID and parent PID
3. Follow the parents all the way up (to the system line) and draw the lineage on paper. Example: mspaint ← powershell ← explorer ← ...
4. From Get-Service, pick 3 Automatic services whose names you don’t know and investigate each one’s identity (search the name and the identity comes up — this is the real investigation method)
5. When finished, close Paint

Exercises

Question 1. When several processes share the same name, what distinguishes them — and does that number attach to the program or to the execution instance?

Question 2. You queried a process’s ParentProcessId, but no process with that number exists in the list. What situation is this, and how should you record it in a report?

Question 3. On Windows 11, the parent of Notepad launched with Start-Process notepad was not my PowerShell. Is it “contaminated by something”? Why does this happen?

Question 4. Why does malware imitate legitimate process names (like svchost.exe)? State the weakness of name-dependent investigation, and two verification items that compensate for it.

Start-Process mspaint
$PID   # note this window's number
Get-CimInstance Win32_Process -Filter "Name = 'mspaint.exe'" |
  Select-Object Name, ProcessId, ParentProcessId

mspaint.exe (21052) ← powershell.exe (26644) ← explorer.exe (6700) ← (parent 5848 has exited)

6. Common Pitfalls & Fixes

Wall 1. Get-CimInstance is too slow

Symptom: a process query is slow. Use a specific CIM -Filter when possible and request only the needed fields. Selecting the first few displayed objects does not guarantee that the provider performed a smaller query.

Wall 2. Syntax errors in Filter

Symptom: a red error of the “query is invalid” kind.
Cause: mostly the quote combination in -Filter "Name = 'mspaint.exe'" is wrong. The rule: double quotes outside, single quotes around the inner value.
Fix: copy the form exactly and change only the name. If it still fails, pulling everything without Filter and narrowing with Where-Object also works.

Wall 3. I can’t find the owner of a ParentProcessId

Symptom: no current process matches the parent PID. It may have exited, or permissions and collection timing may limit visibility. Record that the parent was not found at collection time; do not turn that observation into proof of a particular exit history.

Wall 4. “Cannot find a process” error from Stop-Process

Symptom: a red error appears (Illustrative source example):

Stop-Process : Cannot find a process with the name "mspaint". Verify the process name and call the cmdlet again.

Cause: no process with that name is running — you already closed it, or you mistyped the name. Note that the name you give Stop-Process is the name without the extension (.exe) (mspaint, not mspaint.exe).
Fix: find the real name by searching a partial string, like Get-Process | Where-Object Name -match 'paint'.

Wall 5. Group-Object results aren’t what I expected

Symptom: grouping does not use the expected property. Check spelling and inspect the available properties with Get-Service | Get-Member. PowerShell version and platform can affect the service objects available.

7. Summary

This section’s Concepts

This section’s Commands

A Sense That Matters More Than Commands

“Who launched this?” — the first question of malware analysis, and the thing you learned to trace by number today. Know the normal lineage (explorer → legitimate program), and an abnormal lineage — a document secretly running commands — catches your eye. And a name can be faked, but lineage and path are hard to fake — that is the perspective that catches name-mimicking malware.

Remember two more things. First, you’ll have noticed that svchost.exe appears very many times in the process list — 102 were running on the example computer. It’s a “host” process that runs Windows services on their behalf, which is why there are so many — and that very number is why malware mimics the name. Second, Microsoft’s free tool Process Explorer displays the tree you traced by numbers today as an actual tree diagram. Right now you’re learning the principles through commands; tools show their true worth once you know the principles.

From today, every time you open Task Manager, ask once: “Who launched this one?” A suspicious eye isn’t born overnight — only someone who keeps looking at the ordinary ever sees the extraordinary.

Once every box is checked, Step 13 is complete.