# 🌳 Analyzing Process Trees

Visualizing the chain of execution is critical.

## 📝 The Raw Log
A series of events joined by process ID (PID).

```text
[TIME: 14:00:01] PID: 1044 | svchost.exe (System Service)
    └── [TIME: 14:00:05] PID: 2055 | cmd.exe /c "whoami"
        └── [TIME: 14:00:06] PID: 3100 | conhost.exe
```

## 🕵️‍♂️ Investigation Steps

### Step 1: Identify the Root
* **Root**: `svchost.exe`. This is a generic Windows service host.
* **Issue**: `svchost.exe` launching `cmd.exe` is highly suspicious. It usually points to a compromised service (like a vulnerability in SMB or a web server running as system).

### Step 2: Check the Child Activity
* **Command**: `whoami`.
* **Context**: This is a "Discovery" command. Attackers run it immediately after getting shell access to see who they are (SYSTEM vs User).

### Step 3: The "Conhost"
* `conhost.exe` is normal when `cmd` runs. It handles the console window.

### 🔴 Assessment
This looks like a **Reverse Shell** or **Remote Code Execution (RCE)** exploit.
