Learn how to hunt for stealthy persistence and privilege escalation by inspecting parent-child process anomalies in Microsoft Sysmon and EDR logs.

### Why Process Lineage Matters

Adversaries attempt to disguise malicious processes by spawning them beneath trusted system executables. For instance, seeing `cmd.exe` or `powershell.exe` running as a child process of `winword.exe` or `spoolsv.exe` is a classic anomaly indicator.

In this post, we will construct threat hunting queries using Sysmon Event ID 1 telemetry to expose abnormal process spawning patterns.

Key Anomaly Patterns to Hunt

1. **Office Macro Execution**: - Parent Process: `WINWORD.EXE` / `EXCEL.EXE` - Child Process: `powershell.exe`, `wscript.exe`, `certutil.exe`

2. **Web Server Shell Spawning**: - Parent Process: `w3wp.exe` / `httpd.exe` - Child Process: `cmd.exe` / `sh` / `bash`

3. **LSASS Memory Dumping**: - Parent Process: Any non-SYSTEM user context process - Target Process: `lsass.exe` with granted access `0x1010` or `0x1F0FFF`

Hunting Query (KQL / Microsoft Sentinel)

SysmonEvent1
| where ParentImage endswith "winword.exe" or ParentImage endswith "excel.exe"
| where Image endswith "powershell.exe" or Image endswith "cmd.exe"
| project TimeGenerated, Computer, User, ParentImage, Image, CommandLine
| sort by TimeGenerated desc

Takeaways

Threat hunting requires moving beyond static IOCs toward behavioral anomaly hunting. Mapping queries directly to MITRE ATT&CK techniques ensures comprehensive coverage across the kill chain.