## Reading Process Ancestry: Who is your Father?

To catch advanced attackers, you must understand **Ancestry**. It's not just about the immediate parent, but the "Grandparent" and the whole lineage.

### The "Grandparent" Context
Sometimes, the immediate parent looks okay, but the context is wrong.
**Example**:
`powershell.exe` running a script.
*   Make sense? Maybe. Admins use PowerShell all the time.
*   **Context 1 (Good)**:
    *   Grandparent: `services.exe` -> Parent: `svchost.exe` -> Child: `powershell.exe` (Running a scheduled maintenance task).
*   **Context 2 (Bad)**:
    *   Grandparent: `chrome.exe` -> Parent: `cmd.exe` -> Child: `powershell.exe` (User downloaded a script from the browser and ran it).

### Orphaned Processes
Sometimes, the Parent dies before the Child.
*   `cmd.exe` spawns `malware.exe`.
*   `cmd.exe` closes/exits.
*   `malware.exe` is still running.
In Windows, the Parent ID (PPID) technically points to a non-existent process. Modern EDRs track this linkage historically so you can still see who the *original* parent was.

### Spoofing (PPID Spoofing)
Advanced attackers can trick Windows. They can tell the OS: "Launch my malware, but pretend that `explorer.exe` is the parent, not my hacking tool."
*   This is called **Parent PID Spoofing**.
*   **Detection**: EDRs look for discrepancies between the *recorded* parent and the *start time* of the process. If a Child process claims to be born 5 minutes *before* its Parent started, verified spoofing is likely occurring.

### Standard Ancestry (What is Normal?)
You need to know what "Normal" looks like to spot the "Abnormal".
*   `svchost.exe`: Generic host for services. Should usually be spawned by `services.exe`.
*   `lsass.exe`: Local Security Authority. Should be spawned by `wininit.exe`.
*   `explorer.exe`: The user shell. Spawned by `userinit.exe`.

If you see `lsass.exe` spawned by `winword.exe`, you are looking at an attack (likely Credential Dumping).