2026-04-13 02-17-34

0:11

S… Speaker 1 (2026-04-13 02-17-34)

In this video,

0:12

S… Speaker 1 (2026-04-13 02-17-34)

we're going to take a look at some of the core Windows system

0:17

S… Speaker 1 (2026-04-13 02-17-34)

processes and what to keep an eye out for when

0:21

S… Speaker 1 (2026-04-13 02-17-34)

performing threat hunts in a Windows system.

0:25

S… Speaker 1 (2026-04-13 02-17-34)

So first of all,

0:26

S… Speaker 1 (2026-04-13 02-17-34)

let's take a look at kind of some ways to be able to identify

0:31

S… Speaker 1 (2026-04-13 02-17-34)

processes in general.

0:34

S… Speaker 1 (2026-04-13 02-17-34)

Now remember there's two different kind of definitions,

0:37

S… Speaker 1 (2026-04-13 02-17-34)

if you will,

0:38

S… Speaker 1 (2026-04-13 02-17-34)

for a process.

0:39

S… Speaker 1 (2026-04-13 02-17-34)

We're talking about these specific Windows system processes,

0:43

S… Speaker 1 (2026-04-13 02-17-34)

not just any running file here,

0:46

S… Speaker 1 (2026-04-13 02-17-34)

any running executable.

0:47

S… Speaker 1 (2026-04-13 02-17-34)

So some of the ways that system processes or processes in general really

0:51

S… Speaker 1 (2026-04-13 02-17-34)

can be identified is through the name.

0:54

S… Speaker 1 (2026-04-13 02-17-34)

There's the name of the executable that is running.

0:57

S… Speaker 1 (2026-04-13 02-17-34)

You can also identify a system process through the process ID

1:01

S… Speaker 1 (2026-04-13 02-17-34)

or PID or PID,

1:03

S… Speaker 1 (2026-04-13 02-17-34)

sometimes it's called.

1:05

S… Speaker 1 (2026-04-13 02-17-34)

And also the full path that the executable is

1:09

S… Speaker 1 (2026-04-13 02-17-34)

running from is another good way to be able to identify a system process.

1:14

S… Speaker 1 (2026-04-13 02-17-34)

There's several different things that you can kind of think of

1:18

S… Speaker 1 (2026-04-13 02-17-34)

to be able to try and determine whether or not a given

1:22

S… Speaker 1 (2026-04-13 02-17-34)

process or an application you see running on a system is

1:27

S… Speaker 1 (2026-04-13 02-17-34)

a legitimate core system process.

1:30

S… Speaker 1 (2026-04-13 02-17-34)

Number one.

1:31

S… Speaker 1 (2026-04-13 02-17-34)

is does it have the expected parent process?

1:35

S… Speaker 1 (2026-04-13 02-17-34)

A lot of your core processes will have a very specific

1:40

S… Speaker 1 (2026-04-13 02-17-34)

process that should have launched it.

1:42

S… Speaker 1 (2026-04-13 02-17-34)

Some of them will not have any that will be visible because the process

1:46

S… Speaker 1 (2026-04-13 02-17-34)

that launched it terminated after it was launched.

1:49

S… Speaker 1 (2026-04-13 02-17-34)

But that's something to keep an eye out for.

1:52

S… Speaker 1 (2026-04-13 02-17-34)

Do you see the expected parent process that

1:56

S… Speaker 1 (2026-04-13 02-17-34)

spawned the process you are analyzing?

2:00

S… Speaker 1 (2026-04-13 02-17-34)

Is it running from where you think it should be running from?

2:04

S… Speaker 1 (2026-04-13 02-17-34)

A lot of your core system processes will run from the Windows System

2:08

S… Speaker 1 (2026-04-13 02-17-34)

32 folder on whatever the boot drive is or

2:12

S… Speaker 1 (2026-04-13 02-17-34)

wherever Windows is installed.

2:14

S… Speaker 1 (2026-04-13 02-17-34)

So if you see what looks to be a system process

2:18

S… Speaker 1 (2026-04-13 02-17-34)

running from,

2:19

S… Speaker 1 (2026-04-13 02-17-34)

you know, a user's download folder,

2:21

S… Speaker 1 (2026-04-13 02-17-34)

probably not legitimate.

2:25

S… Speaker 1 (2026-04-13 02-17-34)

Next question is a pretty obvious one.

2:28

S… Speaker 1 (2026-04-13 02-17-34)

Is the executable,

2:30

S… Speaker 1 (2026-04-13 02-17-34)

is the file name spelled right?

2:32

S… Speaker 1 (2026-04-13 02-17-34)

A lot of times attackers will mimic your legitimate

2:36

S… Speaker 1 (2026-04-13 02-17-34)

system processes by misspelling them,

2:39

S… Speaker 1 (2026-04-13 02-17-34)

common misspellings,

2:40

S… Speaker 1 (2026-04-13 02-17-34)

or adding a letter,

2:41

S… Speaker 1 (2026-04-13 02-17-34)

or removing a letter,

2:43

S… Speaker 1 (2026-04-13 02-17-34)

or anything like that.

2:44

S… Speaker 1 (2026-04-13 02-17-34)

That's an easy one you can keep an eye out for.

2:47

S… Speaker 1 (2026-04-13 02-17-34)

Is the file name spelled correctly?

2:50

S… Speaker 1 (2026-04-13 02-17-34)

And if you're performing a threat hunt on the system itself where you have access

2:54

S… Speaker 1 (2026-04-13 02-17-34)

to the file signing information,

2:56

S… Speaker 1 (2026-04-13 02-17-34)

another way to determine whether or not it's legitimate is,

2:59

S… Speaker 1 (2026-04-13 02-17-34)

is the file signed by Microsoft?

3:02

S… Speaker 1 (2026-04-13 02-17-34)

If it's not signed or not signed by Microsoft,

3:05

S… Speaker 1 (2026-04-13 02-17-34)

chances are it's not a legitimate system process.

3:09

S… Speaker 1 (2026-04-13 02-17-34)

So now let's take a look at some of the core system processes that are very

3:13

S… Speaker 1 (2026-04-13 02-17-34)

commonly abused by your attackers.

3:16

S… Speaker 1 (2026-04-13 02-17-34)

Number one we're going to look at is the session manager process

3:21

S… Speaker 1 (2026-04-13 02-17-34)

or SMSS .exe.

3:24

S… Speaker 2 (2026-04-13 02-17-34)

Now, again,

3:25

S… Speaker 1 (2026-04-13 02-17-34)

I said a lot of these are going to be running from the Windows System

3:29

S… Speaker 1 (2026-04-13 02-17-34)

32.

3:30

S… Speaker 1 (2026-04-13 02-17-34)

The exact path or the exact drive might

3:34

S… Speaker 1 (2026-04-13 02-17-34)

vary if you have Windows installed on a different drive or a

3:38

S… Speaker 1 (2026-04-13 02-17-34)

different location.

3:39

S… Speaker 1 (2026-04-13 02-17-34)

So just keep that in mind.

3:41

S… Speaker 1 (2026-04-13 02-17-34)

These are the default locations you will find if it is

3:45

S… Speaker 1 (2026-04-13 02-17-34)

a kind of a typical Windows installation.

3:48

S… Speaker 1 (2026-04-13 02-17-34)

So the smss .exe,

3:50

S… Speaker 1 (2026-04-13 02-17-34)

this is in charge of creating new sessions,

3:54

S… Speaker 1 (2026-04-13 02-17-34)

as the session manager name implies.

3:57

S… Speaker 1 (2026-04-13 02-17-34)

You should only see one running instance of

4:01

S… Speaker 1 (2026-04-13 02-17-34)

this process,

4:02

S… Speaker 1 (2026-04-13 02-17-34)

and the parent process should be listed as system.

4:07

S… Speaker 2 (2026-04-13 02-17-34)

Now, again,

4:08

S… Speaker 1 (2026-04-13 02-17-34)

you may see these in different locations,

4:10

S… Speaker 1 (2026-04-13 02-17-34)

but they should always be running from wherever the Windows folder

4:15

S… Speaker 1 (2026-04-13 02-17-34)

is in the System32 folder inside there.

4:19

S… Speaker 1 (2026-04-13 02-17-34)

Next one is the Client Server Run Subsystem,

4:23

S… Speaker 1 (2026-04-13 02-17-34)

or CSRSS .exe.

4:26

S… Speaker 1 (2026-04-13 02-17-34)

This process is in charge of managing processes and

4:31

S… Speaker 1 (2026-04-13 02-17-34)

threads, mapping drive letters,

4:33

S… Speaker 1 (2026-04-13 02-17-34)

things like that.

4:34

S… Speaker 1 (2026-04-13 02-17-34)

Typically, you're going to see two running instances of

4:39

S… Speaker 1 (2026-04-13 02-17-34)

this process,

4:39

S… Speaker 1 (2026-04-13 02-17-34)

and normally you're not going to see a parent process.

4:44

S… Speaker 1 (2026-04-13 02-17-34)

Again, anytime you see a process that doesn't have a parent

4:48

S… Speaker 1 (2026-04-13 02-17-34)

process, that typically just means that whatever the parent

4:52

S… Speaker 1 (2026-04-13 02-17-34)

process was is no longer running.

4:55

S… Speaker 1 (2026-04-13 02-17-34)

It terminated the process after it launched this process

4:59

S… Speaker 1 (2026-04-13 02-17-34)

at some time.

5:00

S… Speaker 2 (2026-04-13 02-17-34)

Next one is the Windows login process or

5:04

S… Speaker 2 (2026-04-13 02-17-34)

winlogon .exe.

5:06

S… Speaker 1 (2026-04-13 02-17-34)

This,

5:07

S… Speaker 1 (2026-04-13 02-17-34)

as the name implies,

5:08

S… Speaker 2 (2026-04-13 02-17-34)

is responsible for user logins and logoffs.

5:12

S… Speaker 2 (2026-04-13 02-17-34)

Again, usually you're not going to see a parent process on this

5:17

S… Speaker 1 (2026-04-13 02-17-34)

one.

5:17

S… Speaker 2 (2026-04-13 02-17-34)

You have the Windows initialization process that is in charge

5:21

S… Speaker 2 (2026-04-13 02-17-34)

of, you guessed it,

5:22

S… Speaker 1 (2026-04-13 02-17-34)

initializing Windows subsystems.

5:24

S… Speaker 1 (2026-04-13 02-17-34)

This is the wininit .exe.

5:27

S… Speaker 2 (2026-04-13 02-17-34)

You should only normally see one instance of this process

5:32

S… Speaker 2 (2026-04-13 02-17-34)

running, and again,

5:33

S… Speaker 2 (2026-04-13 02-17-34)

usually not going to see a parent process on this.

5:38

S… Speaker 2 (2026-04-13 02-17-34)

Then you have the service control manager.

5:41

S… Speaker 2 (2026-04-13 02-17-34)

Basically,

5:42

S… Speaker 2 (2026-04-13 02-17-34)

this is in charge of loading the services that have

5:46

S… Speaker 2 (2026-04-13 02-17-34)

been defined in the registry on that system.

5:49

S… Speaker 2 (2026-04-13 02-17-34)

It is the services .exe file.

5:52

S… Speaker 1 (2026-04-13 02-17-34)

Again,

5:53

S… Speaker 2 (2026-04-13 02-17-34)

you should see normally only one instance running of

5:57

S… Speaker 1 (2026-04-13 02-17-34)

this process,

5:58

S… Speaker 2 (2026-04-13 02-17-34)

and its parent process will actually be wininit

6:02

S… Speaker 1 (2026-04-13 02-17-34)

.exe.

6:03

S… Speaker 1 (2026-04-13 02-17-34)

So keep that in mind.

6:04

S… Speaker 2 (2026-04-13 02-17-34)

If you see a services .exe running that does not have

6:08

S… Speaker 2 (2026-04-13 02-17-34)

wininit .exe as the process that spawned it,

6:12

S… Speaker 2 (2026-04-13 02-17-34)

it's something to look further into.

6:15

S… Speaker 2 (2026-04-13 02-17-34)

It may be malicious in nature.

6:18

S… Speaker 1 (2026-04-13 02-17-34)

Some more processes,

6:20

S… Speaker 1 (2026-04-13 02-17-34)

and this is a big one that is very commonly abused and attacked

6:24

S… Speaker 1 (2026-04-13 02-17-34)

by attackers.

6:25

S… Speaker 2 (2026-04-13 02-17-34)

The Local Security Authority Subsystem,

6:28

S… Speaker 2 (2026-04-13 02-17-34)

or LSASS .exe,

6:31

S… Speaker 2 (2026-04-13 02-17-34)

very commonly just called LSAS.

6:33

S… Speaker 2 (2026-04-13 02-17-34)

This is in charge of user authentication,

6:37

S… Speaker 2 (2026-04-13 02-17-34)

access token generation.

6:39

S… Speaker 2 (2026-04-13 02-17-34)

It's the process that writes to the security event log.

6:43

S… Speaker 2 (2026-04-13 02-17-34)

you should see one instance of this process running,

6:47

S… Speaker 1 (2026-04-13 02-17-34)

only one,

6:48

S… Speaker 2 (2026-04-13 02-17-34)

and its parent process is wininit

6:52

S… Speaker 1 (2026-04-13 02-17-34)

.exe.

6:53

S… Speaker 2 (2026-04-13 02-17-34)

Now, I mentioned this process is very commonly attacked.

6:57

S… Speaker 2 (2026-04-13 02-17-34)

Attackers will target this process and use it to try

7:01

S… Speaker 2 (2026-04-13 02-17-34)

and dump the password hashes to get

7:06

S… Speaker 2 (2026-04-13 02-17-34)

access to those and try to crack those password hashes on

7:10

S… Speaker 1 (2026-04-13 02-17-34)

a system.

7:11

S… Speaker 2 (2026-04-13 02-17-34)

You'll also very commonly see this one imitated with different

7:15

S… Speaker 1 (2026-04-13 02-17-34)

names,

7:16

S… Speaker 2 (2026-04-13 02-17-34)

either with,

7:17

S… Speaker 1 (2026-04-13 02-17-34)

you know,

7:18

S… Speaker 2 (2026-04-13 02-17-34)

the S and an A transposed or one

7:22

S… Speaker 2 (2026-04-13 02-17-34)

extra S or something like that.

7:24

S… Speaker 2 (2026-04-13 02-17-34)

So this is one definitely to keep an eye on.

7:26

S… Speaker 2 (2026-04-13 02-17-34)

It is very commonly abused and attacked.

7:29

S… Speaker 2 (2026-04-13 02-17-34)

You also have the generic service host process,

7:33

S… Speaker 2 (2026-04-13 02-17-34)

which is svchost .exe.

7:36

S… Speaker 1 (2026-04-13 02-17-34)

Normally,

7:37

S… Speaker 2 (2026-04-13 02-17-34)

you're going to see a lot of these running.

7:39

S… Speaker 1 (2026-04-13 02-17-34)

This will be multiple instances of this,

7:42

S… Speaker 2 (2026-04-13 02-17-34)

and the parent process for these should be services .exe.

7:47

S… Speaker 2 (2026-04-13 02-17-34)

This one also can be commonly abused to launch

7:51

S… Speaker 2 (2026-04-13 02-17-34)

malware because it is in charge.

7:53

S… Speaker 2 (2026-04-13 02-17-34)

It's basically in charge of loading processes that run from

7:57

S… Speaker 1 (2026-04-13 02-17-34)

executables.

7:58

S… Speaker 2 (2026-04-13 02-17-34)

So this one can be used to launch malware as well.

8:02

S… Speaker 2 (2026-04-13 02-17-34)

So keep an eye on what this process may be

8:06

S… Speaker 1 (2026-04-13 02-17-34)

launching.

8:07

S… Speaker 2 (2026-04-13 02-17-34)

Then you have just the generic host process,

8:11

S… Speaker 2 (2026-04-13 02-17-34)

which is taskhostw .exe.

8:14

S… Speaker 2 (2026-04-13 02-17-34)

Now on older versions of Windows,

8:17

S… Speaker 2 (2026-04-13 02-17-34)

the W was not present in this process file

8:21

S… Speaker 2 (2026-04-13 02-17-34)

name. It was just taskhost .exe.

8:24

S… Speaker 2 (2026-04-13 02-17-34)

I don't remember exactly which version of Windows this started changing,

8:28

S… Speaker 2 (2026-04-13 02-17-34)

but all modern versions of Windows that are running

8:32

S… Speaker 1 (2026-04-13 02-17-34)

these days should have the W at the end.

8:35

S… Speaker 2 (2026-04-13 02-17-34)

So it'll be taskhostw .exe.

8:38

S… Speaker 2 (2026-04-13 02-17-34)

Where your svchost .exe

8:43

S… Speaker 2 (2026-04-13 02-17-34)

was in charge of loading processes that run from executables,

8:46

S… Speaker 2 (2026-04-13 02-17-34)

your taskhost is in charge of loading processes

8:50

S… Speaker 1 (2026-04-13 02-17-34)

that run from DLLs.

8:53

S… Speaker 2 (2026-04-13 02-17-34)

And again, its parent process should be services .exe

8:57

S… Speaker 1 (2026-04-13 02-17-34)

as well.

8:58

S… Speaker 1 (2026-04-13 02-17-34)

And then you have Windows Explorer.

9:01

S… Speaker 2 (2026-04-13 02-17-34)

This is the one out of this list that is not running

9:05

S… Speaker 2 (2026-04-13 02-17-34)

out of the System32 folder.

9:08

S… Speaker 1 (2026-04-13 02-17-34)

Windows Explorer,

9:09

S… Speaker 2 (2026-04-13 02-17-34)

it's responsible for the user's desktop,

9:11

S… Speaker 2 (2026-04-13 02-17-34)

adding access to files,

9:14

S… Speaker 2 (2026-04-13 02-17-34)

things like that.

9:15

S… Speaker 2 (2026-04-13 02-17-34)

A lot of times you'll see this appearing possibly with no parent

9:19

S… Speaker 2 (2026-04-13 02-17-34)

process, but you should only see one instance of

9:23

S… Speaker 2 (2026-04-13 02-17-34)

this running.

9:24

S… Speaker 2 (2026-04-13 02-17-34)

Now, I mentioned that a lot of these processes will

9:29

S… Speaker 2 (2026-04-13 02-17-34)

typically run from your Windows folder or your System32 folder,

9:33

S… Speaker 2 (2026-04-13 02-17-34)

things like that.

9:34

S… Speaker 2 (2026-04-13 02-17-34)

Your core Windows processes should never run

9:39

S… Speaker 2 (2026-04-13 02-17-34)

from locations like temp folders or the recycle

9:44

S… Speaker 2 (2026-04-13 02-17-34)

bin or any other kind of suspicious locations like

9:48

S… Speaker 2 (2026-04-13 02-17-34)

that. They should always be running from the Windows root folder,

9:52

S… Speaker 2 (2026-04-13 02-17-34)

Windows or Windows System 32.

9:54

S… Speaker 2 (2026-04-13 02-17-34)

If you see them running from other locations,

9:56

S… Speaker 2 (2026-04-13 02-17-34)

that's a red flag.

9:58

S… Speaker 1 (2026-04-13 02-17-34)

Also,

9:59

S… Speaker 2 (2026-04-13 02-17-34)

your core system processes should never be communicating

10:03

S… Speaker 2 (2026-04-13 02-17-34)

with outbound IPs.

10:06

S… Speaker 2 (2026-04-13 02-17-34)

If you see any process that is imitating or

10:10

S… Speaker 2 (2026-04-13 02-17-34)

looks to be a core system process that's communicating

10:14

S… Speaker 2 (2026-04-13 02-17-34)

with an IP address,

10:15

S… Speaker 2 (2026-04-13 02-17-34)

an outside IP address,

10:17

S… Speaker 2 (2026-04-13 02-17-34)

chances are it is malicious.

10:20

S… Speaker 2 (2026-04-13 02-17-34)

And that's one location where Sysmon events come

10:24

S… Speaker 1 (2026-04-13 02-17-34)

in as well.

10:25

S… Speaker 2 (2026-04-13 02-17-34)

And we'll get into how to identify those with those event

10:29

S… Speaker 2 (2026-04-13 02-17-34)

IDs and how to look at network communication with Sysmon and things like

10:33

S… Speaker 2 (2026-04-13 02-17-34)

that as we continue going through this course.

10:36

S… Speaker 2 (2026-04-13 02-17-34)

But the key to remember here is the locations from where these processes

10:40

S… Speaker 1 (2026-04-13 02-17-34)

are running.

10:41

S… Speaker 2 (2026-04-13 02-17-34)

Should be the system 32 or the Windows folders,

10:45

S… Speaker 2 (2026-04-13 02-17-34)

depending on the process.

10:47

S… Speaker 2 (2026-04-13 02-17-34)

Not locations like temp folders,

10:49

S… Speaker 1 (2026-04-13 02-17-34)

not the recycle bin,

10:50

S… Speaker 2 (2026-04-13 02-17-34)

not download locations,

10:51

S… Speaker 2 (2026-04-13 02-17-34)

not from a user's folder.

10:53

S… Speaker 2 (2026-04-13 02-17-34)

No locations like that.

10:56

S… Speaker 2 (2026-04-13 02-17-34)

So there's a few different ways to be able to just generically recognize

11:01

S… Speaker 2 (2026-04-13 02-17-34)

some of your more malicious processes.

11:04

S… Speaker 1 (2026-04-13 02-17-34)

So for example,

11:05

S… Speaker 2 (2026-04-13 02-17-34)

if you have any process that launches a

11:09

S… Speaker 2 (2026-04-13 02-17-34)

child process of either cmd .exe or

11:14

S… Speaker 2 (2026-04-13 02-17-34)

wscript .exe or powershell .exe,

11:18

S… Speaker 2 (2026-04-13 02-17-34)

any process that launches a child process of any of those

11:23

S… Speaker 1 (2026-04-13 02-17-34)

three,

11:23

S… Speaker 2 (2026-04-13 02-17-34)

Chances are it's going to be malicious in nature.

11:27

S… Speaker 1 (2026-04-13 02-17-34)

Now, of course,

11:28

S… Speaker 2 (2026-04-13 02-17-34)

there's maybe some exceptions there.

11:30

S… Speaker 2 (2026-04-13 02-17-34)

These are just guidelines.

11:31

S… Speaker 2 (2026-04-13 02-17-34)

But that is definitely something you want to look at.

11:34

S… Speaker 2 (2026-04-13 02-17-34)

So if you have something like wininit .exe that launched PowerShell

11:39

S… Speaker 2 (2026-04-13 02-17-34)

or lsas .exe that launched command .exe,

11:43

S… Speaker 2 (2026-04-13 02-17-34)

that is something that you would want to investigate further

11:47

S… Speaker 1 (2026-04-13 02-17-34)

as well.

11:49

S… Speaker 2 (2026-04-13 02-17-34)

Then you have a couple of event IDs associated with Sysmon

11:53

S… Speaker 2 (2026-04-13 02-17-34)

that can be used to help hunt your Windows processes

11:57

S… Speaker 1 (2026-04-13 02-17-34)

as well.

11:58

S… Speaker 1 (2026-04-13 02-17-34)

Number one is,

11:59

S… Speaker 1 (2026-04-13 02-17-34)

well, number one,

12:00

S… Speaker 2 (2026-04-13 02-17-34)

Sysmon event ID one.

12:03

S… Speaker 2 (2026-04-13 02-17-34)

This is for process creation.

12:05

S… Speaker 2 (2026-04-13 02-17-34)

This will contain information about newly created

12:09

S… Speaker 1 (2026-04-13 02-17-34)

processes on a system,

12:11

S… Speaker 2 (2026-04-13 02-17-34)

including the full command line that was used to launch the process

12:15

S… Speaker 2 (2026-04-13 02-17-34)

and where the process is launching from.

12:18

S… Speaker 2 (2026-04-13 02-17-34)

and the file hash of the file that was launched.

12:22

S… Speaker 2 (2026-04-13 02-17-34)

So that's another good way to be able to compare it against known

12:26

S… Speaker 2 (2026-04-13 02-17-34)

good Windows system process.

12:29

S… Speaker 2 (2026-04-13 02-17-34)

You have the hashes for those.

12:31

S… Speaker 1 (2026-04-13 02-17-34)

If it doesn't match,

12:33

S… Speaker 2 (2026-04-13 02-17-34)

requires additional investigation.

12:35

S… Speaker 2 (2026-04-13 02-17-34)

Then you have event ID 10.

12:38

S… Speaker 2 (2026-04-13 02-17-34)

Again, also Sysmon.

12:40

S… Speaker 2 (2026-04-13 02-17-34)

This is for process access.

12:42

S… Speaker 2 (2026-04-13 02-17-34)

This event ID will report on when a process opens

12:47

S… Speaker 2 (2026-04-13 02-17-34)

another process.

12:49

S… Speaker 1 (2026-04-13 02-17-34)

Normally,

12:50

S… Speaker 2 (2026-04-13 02-17-34)

that kind of activity is going to be followed by reading and writing,

12:53

S… Speaker 1 (2026-04-13 02-17-34)

or one of the two,

12:54

S… Speaker 2 (2026-04-13 02-17-34)

reading or writing the address space of that target

12:59

S… Speaker 2 (2026-04-13 02-17-34)

process.

13:00

S… Speaker 2 (2026-04-13 02-17-34)

This is a common technique that attackers will use to

13:04

S… Speaker 2 (2026-04-13 02-17-34)

steal credentials to be used later in past the hash attacks.

13:09

S… Speaker 2 (2026-04-13 02-17-34)

So two event IDs associated with Sysmon that are very

13:13

S… Speaker 2 (2026-04-13 02-17-34)

useful when you're doing any sort of endpoint threat hunting and

13:18

S… Speaker 2 (2026-04-13 02-17-34)

looking at what processes or processes

13:22

S… Speaker 2 (2026-04-13 02-17-34)

that claim to be Windows system processes.

2026-04-13 02-17-34

Famintinana

Manontany ny AI momba ity dika mitovy ity