## The Process Tree: The DNA of an Attack

If you learn only one thing about EDR, let it be the **Process Tree** (or Parent-Child Relationship).

### What is a Process?
When you run a program (like Calculator), the Operating System creates a **Process**. It assigns it a **PID (Process ID)**.

### Parent and Child
Processes do not appear out of thin air. They are spawned by other processes.
*   **Parent**: The creator.
*   **Child**: The created.

**Normal Example**:
1.  You double-click Chrome on your desktop.
    *   Parent: `explorer.exe` (The Windows Desktop)
    *   Child: `chrome.exe`
2.  You open a PDF inside Chrome.
    *   Parent: `chrome.exe`
    *   Child: `AcrobatReader.exe`

**Malicious Example**:
1.  User opens an email attachment (`Invoice.docx`).
    *   Parent: `outlook.exe`
    *   Child: `winword.exe`
2.  The document contains a malicious macro.
    *   Parent: `winword.exe`
    *   Child: `cmd.exe` (Command Prompt) **<-- RED FLAG**
3.  The Command Prompt downloads malware.
    *   Parent: `cmd.exe`
    *   Child: `powershell.exe`

### Visualizing the Tree
EDR tools visualize this as a hierarchy DAG (Directed Acyclic Graph).
```
explorer.exe (PID 1000)
    |
    |-- outlook.exe (PID 1200)
         |
         |-- winword.exe (PID 1300)  <-- "Invoice.docx"
              |
              |-- cmd.exe (PID 1400) <-- "Active Malicious Content"
                   |
                   |-- curl.exe (PID 1500)
```

### The Analyst's Job
Your job is to look at this tree and ask: **"Does this make sense?"**
*   Does Microsoft Word *need* to open the Command Prompt to show you a document? **No.**
*   Does Adobe Reader *need* to run PowerShell to display a PDF? **No.**
*   Does Chrome *need* to run the Calculator? **No.**

These illogical relationships are the **strongest indicators of compromise (IOCs)** in existence. They are harder for attackers to hide than file hashes or IP addresses.