Windows Processes

What a process is made of, what normal looks like, the signs that one does not belong and how to check.

A process is a program while it runs. Windows gives each one its own number, the process ID (PID), its own memory and an account to act as. Almost any code an attacker runs on a Windows machine runs as a process or inside one. That makes the list of running processes one of the first places an investigator looks.

Two Ways to Look

The first way is live. You run a tool on the machine while the process is still going, and the tool asks Windows what it knows. The second is a memory image. That is a copy of everything in the machine's memory (RAM), saved to a file at one moment like a photograph, which you study later on another computer. Code that hides from live tools often still shows in the copy.

Live Machine

  1. Your tool
  2. asksWindows on the machine
  3. answers withWhat is running now

Quick, but it sees only what Windows reports, and running malware can hide from it.

Memory Image

  1. The machine's memory
  2. copied toA memory image file
  3. read later byA tool on another computer

One moment in time, but nothing on the machine can change the copy.

Logs add a third view. They record what happened earlier, such as each process start, which neither way can still see.

Tools You Will Meet

The pages name these tools. Each one asks a live machine, reads a memory image or searches the records machines keep.

On a Live Machine

  • Task ManagerBuilt into Windows. It lists the programs running now and how much of the machine each one uses.
  • Process ExplorerA free Microsoft tool that works like a detailed Task Manager. It shows each process under the one that started it, with its DLLs and handles.
  • Defender Live ResponsePart of Defender for Endpoint. It opens a command console on one machine from the Defender portal, so you can list its processes from your desk.
  • VelociraptorA free, open-source tool that asks one machine or thousands the same question at once. Each ready-made question is called an artifact.

In a Memory Image

  • Volatility 3A free, open-source tool that reads a memory image on another computer. Each check it runs is called a plugin.

In Logs and Records

  • SysmonA free Microsoft add-on that writes a record of each process start, network connection and more to its own Windows event log.
  • Defender XDRMicrosoft's security product. Its sensor on each machine, Defender for Endpoint, records what happens there. You can search the last 30 days of those records with its query language, KQL. Source: Microsoft Learn (opens in a new tab)
  • Microsoft SentinelMicrosoft's cloud log platform. It gathers records from many sources in one place, and you search it with the same KQL as Defender XDR.
  • A log platform that gathers records from many sources in one place. You search it with its own language, SPL (Search Processing Language).

Reading a Check's Name

Velociraptor calls each check an artifact and Volatility 3 calls it a plugin. Both name them from general to specific, like a folder path.

Volatility 3 plugin

  1. windowsAreaA Windows memory image
  2. malwareGroupChecks for hidden code
  3. psxviewCheckProcess cross view

Velociraptor artifact

  1. WindowsAreaWindows machines
  2. SystemGroupWhat runs on the system
  3. PslistCheckProcess list

psxview compares several of Windows' own lists of processes, so a process hiding from one of them stands out.

Inside a Process

A process is more than a name in a list. These pages open one up part by part, so start with what it is made of.

  • What a Process Is Made OfStart Here

    The parts every process has, why Windows needs each one, and who keeps it.

  • Loaded DLLs

    The modules inside each process, where each came from and who signed it.

  • Handles, Pipes and Mutexes

    What a process holds open, such as files, keys, other processes, pipes and mutexes.

  • Memory Regions

    A process's memory, region by region, with what each holds and how it may be used.

  • Threads

    What runs inside a process, and where each thread starts.

  • Network Connections

    Every connection and listening port tied to the process that owns it, live and in memory.

  • Token and Privileges

    Who a process runs as, with its account, groups, privileges and integrity level.

  • Command Line and Environment

    What each process was told to do, from creation records, the live system and memory.

Normal Processes

The window lists the core processes of a clean Windows 11 machine. Each row sits under the process that started it, as in Task Manager's tree. Pick a row to see what a genuine copy looks like.

Switch to Malicious Example to see ws-042, a fictional Windows 11 workstation used by alice, as an investigator found it at 10:08 UTC on 12 Oct 2026. The investigator flagged five of its processes. Two of them, a service and the command prompt it started, come from PsExec, a Microsoft tool that runs programs on other machines. The others include a service binary in C:\Windows\Temp and the genuine print spooler with code running inside it. Every page follows this one machine.

Processes
Name
PID
Parent
Path
Status
System
PID 4
None
No program file
Running
Registry
PID 88
System
No program file
Running
smss.exe
PID 108
System
C:\Windows\System32\smss.exe
Running
smss.exe
PID 332
smss.exe
C:\Windows\System32\smss.exe
Exited
csrss.exe
PID 356
smss.exe, exited
C:\Windows\System32\csrss.exe
Running
wininit.exe
PID 372
smss.exe, exited
C:\Windows\System32\wininit.exe
Running
services.exe
PID 504
wininit.exe
C:\Windows\System32\services.exe
Running
spoolsv.exe
PID 808
services.exe
C:\Windows\System32\spoolsv.exe
Running
MsMpEng.exe
PID 836
services.exe
C:\ProgramData\Microsoft\Windows Defender\Platform\<version>\MsMpEng.exe
Running
LsaIso.exe
PID 532
wininit.exe
C:\Windows\System32\LsaIso.exe
Not always
lsass.exe
PID 556
wininit.exe
C:\Windows\System32\lsass.exe
Running
fontdrvhost.exe
PID 580
wininit.exe
Not stated
Running
smss.exe
PID 400
smss.exe
C:\Windows\System32\smss.exe
Exited
csrss.exe
PID 408
smss.exe, exited
C:\Windows\System32\csrss.exe
Running
winlogon.exe
PID 428
smss.exe, exited
C:\Windows\System32\winlogon.exe
Running
fontdrvhost.exe
PID 604
winlogon.exe
Not stated
Running
dwm.exe
PID 632
winlogon.exe
C:\Windows\System32\dwm.exe
Running
LogonUI.exe
PID 660
winlogon.exe
C:\Windows\System32\LogonUI.exe
While shown
userinit.exe
PID 912
winlogon.exe
C:\Windows\System32\userinit.exe
Exited
explorer.exe
PID 968
userinit.exe, exited
C:\Windows\explorer.exe
Running
SecurityHealthSystray.exe
PID 1080
explorer.exe
Not stated
Running
cmd.exe
PID 1108
explorer.exe
Not stated
Running
conhost.exe
PID 1136
cmd.exe
C:\Windows\System32\conhost.exe
Not always
Memory Compression
PID 780
System
No program file
Running

explorer.exe

Windows Shell, as the signed-in personPID 968, parent PID 912

The default shell, and the usual parent of the programs a person starts.

Normal Profile

A genuine copy shows these values.

Parent
userinit.exeLive tools usually show no parent, as userinit.exe has exited by then.
Path
The Windows folder (a value that published detection rules check for)C:\Windows\explorer.exeA 32-bit copy lives in C:\Windows\SysWOW64.
Account
The person signed in
Session
The person's session
Instances
Count copies per person on a clean machine of the same build, with the same folder options.
Starts
At sign-in, after userinit.exeA late start alone proves little, because the shell can be restarted without a new sign-in.
Command Line
Read it with Get-CimInstance Win32_Process on a clean machine of the same build.
Signed By
Check the file with Sigcheck, which reads catalogue signatures too, on a clean machine of the same build.

A value that published detection rules check for.No public source states this value, so compare with a clean machine of the same Windows build.

How Attackers Abuse It

Each line links to the page that shows how to spot it.

  • Code put into explorer.exe runs as the signed-in person, under a name every user trusts. Remote Thread Injection
  • A program set to run at sign-in starts under explorer.exe, and a Windows name running from a user folder is the one to check. Wrong Path

Red Flags

Each sign links to the page that confirms it.

Can Your Tools See It?

Each mark says whether that tool can see it. Press one for its query.

Open the Full Page for explorer.exeCore processes only

Clean Windows 11 with one person signed in. It shows core processes only, and the PIDs are examples. Not stated means no source this wiki cites gives that value, so compare with a clean machine of the same Windows build.Clean Windows 11. PIDs are examples.Arrow keys walk the list

Red Flags and How to Confirm Them

Most of what is wrong in a process list shows as something out of place. It might be a trusted name in the wrong folder or a core process with an odd parent. No sign is proof on its own, so treat each one as a lead. Each card opens the page that shows how to confirm it.

How Malware Hides in a Process

Here code runs inside or behind a trusted process, so the process list can look normal. Each card says which evidence sees it. EDR telemetry is the record a security product such as Defender for Endpoint keeps of what each process did. A process that only wears a trusted name or path is covered by Misspelt and Look-Alike Names, Wrong Path and Renamed, Unsigned or Falsely Signed Binaries.

  • Remote Thread Injection

    A thread one process started in another, running code that no file on disk backs.

    • Memory
    • EDR Telemetry
    • Logs, partly
  • Process Hollowing

    A genuine-looking process whose image in memory is not the file it started from.

    • Memory
    • EDR Telemetry, partly
    • Logs, partly
  • DLL Search Order Hijacking and Side-Loading

    A trusted program loading a DLL from the wrong folder, because of where it looks first.

    • Memory
    • EDR Telemetry
    • Disk, partly
    • Logs, partly
  • Parent Process Spoofing

    A recorded parent that is not the process that really created the child.

    • Memory, partly
    • EDR Telemetry, partly
    • Logs, partly
  • Abused Built-In and Admin Tools

    Genuine built-in and admin tools, like rundll32.exe or PsExec, used to run or fetch code.

    • Memory, partly
    • EDR Telemetry
    • Disk, partly
    • Logs, partly

Eight more technique pages are being written.

How to Check

These pages are the ways to check a process, from listing every one to capturing its memory for later.