> For the complete documentation index, see [llms.txt](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/zyberlab/05-sysmon-and-endpoint-visibility/parent-child-processes.md).

# Understand Parent and Child Processes

## Objective

Use Sysmon to understand how one process can start another process and why that relationship matters during an investigation.

## Generate a Simple Process Chain

On `CLIENT01`:

1. Open **Command Prompt**.
2. From Command Prompt, run:

```
notepad.exe
```

3. Leave Notepad open for a moment.
4. Close Notepad.

## Review the Sysmon Events

Open the Sysmon Operational log and filter for Event ID:

```
1
```

Find the Process Create event for `notepad.exe`.

Review:

* Image
* ProcessGuid
* ProcessId
* CommandLine
* ParentImage
* ParentProcessGuid
* ParentProcessId
* User

The important relationship should be similar to:

```
cmd.exe
   starts
notepad.exe
```

## Why the Parent Process Matters

The same executable can have different meanings depending on how it started.

For example:

```
explorer.exe
   starts
notepad.exe
```

may represent a user opening Notepad normally.

Another parent process may indicate a different workflow that deserves investigation.

The parent process does not automatically make an event good or bad. It provides context.

## Process GUID and Process ID

A Process ID is a number assigned by Windows while a process is running. Windows may reuse that number later.

Sysmon also records a Process GUID. This helps distinguish one process instance from another and makes event correlation easier.

## Investigation Questions

For the Notepad event, answer:

1. What is the child process?
2. What is the parent process?
3. Which user ran the process?
4. What command line started the child?
5. What Process GUID belongs to the child?
6. Does the relationship make sense based on the action you performed?

## Security Relevance

Process relationships are commonly used when investigating endpoint activity.

A process name by itself may look normal. Understanding which process launched it, which user was involved, and what command line was used can reveal much more about the activity.

## Verification

The lab is complete when you can explain the difference between a parent process and a child process and identify both in a Sysmon Process Create event.