> For the complete documentation index, see [llms.txt](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/zyberlab/07-security-investigation-basics/investigate-process-activity.md).

# Investigate Unusual Process Activity

## Objective

Use Sysmon to investigate a simple process chain on `CLIENT01` and determine which process started another process.

The exercise uses normal Windows applications. The goal is to practice process investigation without introducing malware or offensive tooling.

## Lab System

* `CLIENT01`

## Generate Test Activity

1. Open Command Prompt manually.
2. From Command Prompt, start Notepad by typing:

```
notepad
```

3. Close Notepad after a few seconds.

This creates a simple parent and child process relationship that can be reviewed safely.

## Find the Evidence

On `CLIENT01`, open:

```
Event Viewer
Applications and Services Logs
Microsoft
Windows
Sysmon
Operational
```

Filter for:

```
1
```

Sysmon Event ID `1` records process creation when enabled by the Sysmon configuration.

## Investigate the Events

Find the event for `notepad.exe` and review:

* Image
* ProcessId
* ParentImage
* ParentProcessId
* User
* CommandLine
* time created

The parent process should help explain how Notepad was started.

## Investigation Questions

1. Which executable started?
2. Which user started it?
3. What was the parent process?
4. Does the command line match the activity you performed?
5. Did any unexpected process appear in the same time window?

## Build the Relationship

The process relationship should look similar to this:

```
cmd.exe
   ↓
notepad.exe
```

## Security Relevance

Process names alone are not always enough to understand activity.

Parent process, command line, user context, and timing can help explain why a process started and whether its behavior is expected.

This same investigation method can later be applied to more complex endpoint alerts.