Process Creation & Lineage (Event ID 1)

What is it?

Event ID 1 (Process Create) records every new process with its parent, full command line, image path and hash. Chaining each process to its parent reconstructs the lineage — the family tree of execution.

Why it matters

Most intrusions are visible as an abnormal lineage: a document spawning a script spawning an unknown binary. The parent-child chain, not any single process, is the signal.

Where you see it

An EID 1 event shows ParentImage, Image, CommandLine and Hashes. Following ParentImage upward builds the tree.

What normal looks like

explorer.exe as the parent of user apps; services.exe as the parent of services — expected, well-known parentage.

What suspicious looks like

An Office app or a script parenting powershell/cmd with an encoded or downloading command line, or a system-looking binary running from a user path.

How analysts investigate

Start from the suspicious process, walk ParentImage upward to the root, read each command line, and judge whether that lineage is one a benign workflow would ever produce.

Common beginner mistakes

Looking at the child process alone and missing that its PARENT is the anomaly.
Ignoring the command line, where encoded/downloading intent is usually visible.

Read the family tree

  EID1 lineage (follow Parent → child):
    explorer.exe
      └─ WINWORD.EXE   Cmd: Invoice.docm
           └─ powershell.exe  Cmd: -nop -w hidden -enc SQBFAFgA...
                └─ svc.exe   (C:\Users\Public)  hash=abc123
  the CHAIN (office→ps-enc→public exe) is the finding, not svc.exe alone

Event ID 1 lets you reconstruct parent/child lineage; the abnormal chain is the signal.

Quick check

Which is the strongest indicator of malicious execution?

A quick self-check — it doesn't affect your XP or progress.