Who Starts What
The parent each way of starting a program leaves, and the record that shows it.
- Normal Processes
Why It Matters
An odd child process usually names the way it was started, such as a service, a task, a remote command or a document. Knowing the parent each method leaves turns a strange tree into a named method, and tells you which log to read next.
What Happens
Every way of starting a program leaves a typical parent, the process Windows records as having started it. Services start under services.exe, scheduled tasks under the service host that runs the Task Scheduler, and programs set to run at sign-in under explorer.exe. Remote methods each leave a host of their own.
PowerShell remoting runs commands under wsmprovhost.exe and Windows Remote Shell under winrshost.exe, both started by a service host after a connection to WinRM on port 5985 or 5986. WMI runs commands under its provider host, WmiPrvSE.exe, and PsExec installs a service, PSEXESVC by default, whose binary starts the command.
WMI event subscriptions leave two different hosts. A command-line consumer starts its program from WmiPrvSE.exe, while a script consumer runs its script inside scrcons.exe as LocalSystem, and a service host starts scrcons.exe. Sysmon events 19, 20 and 21 in Microsoft-Windows-Sysmon/Operational record the filter, the consumer and the binding when the subscription is made, where the Sysmon configuration logs WMI events.
A parent names the method, not the person, so pair each odd child with the logon that carried it on the target, and remember that a recorded parent can be set falsely. On ws-042, the cmd.exe running as SYSTEM under PSEXESVC.exe at 09:58 UTC on 12 Oct 2026 is the PsExec row.
As an illustration from another day, not part of that incident, take srv-app-01, the web application server. A cmd.exe there whose parent is w3wp.exe, running as an application pool account, would be the web shell row, since an IIS worker has no reason to open a shell.
The Parent Each Method Leaves on the Machine Where the Program Runs
Each row is one way a program can be started. It gives the parent left on the machine where the program runs, the record that shows it and the MITRE ATT&CK technique with its id. Security events need their audit setting on, such as Audit Process Creation for event 4688. Sysmon events land in Microsoft-Windows-Sysmon/Operational only on machines running Sysmon, so check which your machines keep before you rely on a row.
| Method | Parent on the Machine | What Records It | MITRE ATT&CK Technique |
|---|---|---|---|
| A program a person opens | explorer.exe | Security event 4688 or Sysmon event 1 | None, as this is normal use |
| A service | services.exe | System event 7045 and Security event 4697 when it is installed, then Security event 4688 or Sysmon event 1 at each start | System Services: Service Execution (T1569.002) |
| A scheduled task | svchost.exe, the host running the Schedule service | Security event 4698 when the task is created, then Security event 4688 or Sysmon event 1 at each run | Scheduled Task/Job: Scheduled Task (T1053.005) |
| A Run key or the Startup folder | explorer.exe, just after sign-in | Sysmon event 13 when a Run value is written, then Security event 4688 or Sysmon event 1 at each sign-in | Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder (T1547.001) |
| The Winlogon Shell value | userinit.exe | Sysmon event 13 when the value changes, then Security event 4688 or Sysmon event 1 at each sign-in | Boot or Logon Autostart Execution: Winlogon Helper DLL (T1547.004) |
| The Winlogon Userinit value | winlogon.exe, beside userinit.exe | Sysmon event 13 when the value changes, then Security event 4688 or Sysmon event 1 at each sign-in | Boot or Logon Autostart Execution: Winlogon Helper DLL (T1547.004) |
| WMI, from this machine or another | WmiPrvSE.exe | Security event 4688 or Sysmon event 1, and Velociraptor's Windows. | Windows Management Instrumentation (T1047) |
| A WMI command-line event consumer | WmiPrvSE.exe | Sysmon events 19, 20 and 21 when the subscription is made | Event Triggered Execution: Windows Management Instrumentation Event Subscription (T1546.003) |
| A WMI script event consumer | scrcons.exe, itself started by svchost.exe | Sysmon events 19, 20 and 21, then Security event 4688 or Sysmon event 1 for scrcons.exe | Event Triggered Execution: Windows Management Instrumentation Event Subscription (T1546.003) |
| PowerShell remoting | wsmprovhost.exe, itself started by svchost.exe | Security event 4688 or Sysmon event 1, and event 4104 in Microsoft-Windows-Power | Remote Services: Windows Remote Management (T1021.006) |
| Windows Remote Shell (winrs) | winrshost.exe, itself started by svchost.exe | Security event 4688 or Sysmon event 1 | Remote Services: Windows Remote Management (T1021.006) |
| DCOM | mmc.exe or another COM server, or explorer.exe for the shell window objects | Security event 4688 or Sysmon event 1, just after an incoming connection to that process | Remote Services: Distributed Component Object Model (T1021.003) |
| PsExec | PSEXESVC.exe, a service under services.exe | System event 7045 for the PSEXESVC service, and Sysmon events 17 and 18 for its pipe | System Services: Service Execution (T1569.002) and Remote Services: SMB/Windows Admin Shares (T1021.002) |
| An Office document | WINWORD.EXE, EXCEL.EXE or POWERPNT.EXE | Security event 4688 or Sysmon event 1, and the ASR action in the DeviceEvents table where the rule against Office child processes runs | User Execution: Malicious File (T1204.002) |
| A web shell | w3wp.exe, or another web server worker | Security event 4688 or Sysmon event 1 on the web server | Server Software Component: Web Shell (T1505.003) |
| An accessibility tool at the sign-in screen | winlogon.exe or Utilman.exe, with a shell running as SYSTEM | Security event 4688 or Sysmon event 1, and Sysmon event 13 when an Image File Execution Options value is set | Event Triggered Execution: Accessibility Features (T1546.008) |
In the Process Tree
These are the rows of the process list that this page explains.
WmiPrvSE.exeWMI Provider Host, started by a service hostNot alwaysStarts when a WMI query needs a provider, and WMI unloads idle providers, so copies come and goOpen it in the tree: WmiPrvSE.exeSecurityHealthSystray.exeWindows Security icon, from a Run keyOpen it in the tree: SecurityHealthSystray.execmd.exeA command prompt the person openedOpen it in the tree: cmd.exe
On ws-042, 12 Oct 2026
PSEXESVC.exePsExec's service, as SYSTEMSuspiciousOpen it in the tree: PSEXESVC.exe
Red Flags
Each sign below links to the page that shows how to confirm it.
- Read an odd parent against this table, since it usually names the method that started the child.Wrong Parent
- PsExec and WMI run commands through signed binaries, so judge where and why they ran, not the signature.Abused Built-In and Admin Tools
- A recorded parent can be set falsely, so pair the tree with the logon that carried the command.Parent Process Spoofing
What Records It
Each record names its log and what must be switched on to get it.
| Record and Where It Lands | What to Read | How to Turn It On |
|---|---|---|
4688 A new process has been created (opens in a new tab)SecurityIt is written on the computer the process ran on. | Creator Process Name of each new process, which should be the host this table names for its method.Process Trees and Call Chains shows how to read it. | Turn on Audit Process Creation. For the command line, also turn on Include command line in process creation events. |
| Device | Initiating | The Defender for Endpoint sensor on the device |
7045 New Service Installed (opens in a new tab)SystemThe Service Control Manager writes it on the computer the service was installed on. | A new service with its name and binary, such as PSEXESVC for PsExec unless renamed, or a binary in a temporary folder. | On by default |
4697 A service was installed in the system (opens in a new tab)SecurityIt is written on the computer the service was installed on. | The Security log twin of 7045, with the service account. It needs Audit Security System Extension. | Turn on Audit Security System Extension. |
4698 A scheduled task was created (opens in a new tab)SecurityIt is written on the computer the task was created on. | A new scheduled task, whose XML in Task Content names the program it runs and the account. | Turn on Audit Other Object Access Events. |
13 RegistryEvent (Value Set) (opens in a new tab)Microsoft-Windows-Sysmon/OperationalIt is written on any Windows computer running Sysmon. | A Run, Winlogon or Image File Execution Options value written, with the process that wrote it. | Run Sysmon with RegistryEvent events in its configuration. |
20 WmiEvent (WmiMicrosoft-Windows-Sysmon/OperationalIt is written on any Windows computer running Sysmon. | A WMI consumer registered. A command-line consumer runs under WmiPrvSE.exe, and a script consumer in scrcons.exe. | Run Sysmon with WmiEvent events in its configuration. |
17 PipeEvent (Pipe Created) (opens in a new tab)Microsoft-Windows-Sysmon/OperationalIt is written on any Windows computer running Sysmon. | The PSEXESVC pipe, PsExec's default, with the process that created it.Handles, Pipes and Mutexes shows how to read it. | Run Sysmon with PipeEvent events in its configuration. |
AsrDeviceEventsDefender XDR, advanced hunting | Processes PsExec or WMI tried to create, where that ASR rule runs in audit or block mode. | The Defender for Endpoint sensor on the device |
Hunt It
The same hunt is written for four tools, so pick the one you use. Defender XDR and Sentinel queries are in KQL, which you paste into Advanced hunting in the Defender portal or into Sentinel's Logs page. Splunk queries are in SPL, for its Search page, and Velociraptor queries are in VQL, which you run as a hunt.
Reads the DeviceProcessEvents table in Defender XDR advanced hunting, from devices onboarded to Defender for Endpoint. PsExec's service can be renamed, so also read new service binaries from event 7045 in the System log. Management tools use WMI and WinRM too, so rare rows come first.
// Processes started by remote execution hosts: PsExec's service, WMI and WinRMDeviceProcessEvents| where Timestamp > ago(Sources
- MITRE ATT&CK T1569.002: System Services: Service Execution (opens in a new tab)
- MITRE ATT&CK T1053.005: Scheduled Task/Job: Scheduled Task (opens in a new tab)
- MITRE ATT&CK T1547.001: Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder (opens in a new tab)
- MITRE ATT&CK T1047: Windows Management Instrumentation (opens in a new tab)
- MITRE ATT&CK T1546.003: Event Triggered Execution: Windows Management Instrumentation Event Subscription (opens in a new tab)
- MITRE ATT&CK T1546.008: Event Triggered Execution: Accessibility Features (opens in a new tab)
- MITRE ATT&CK T1021.002: Remote Services: SMB/Windows Admin Shares (opens in a new tab)
- MITRE ATT&CK T1021.003: Remote Services: Distributed Component Object Model (opens in a new tab)
- MITRE ATT&CK T1021.006: Remote Services: Windows Remote Management (opens in a new tab)
- MITRE ATT&CK T1505.003: Server Software Component: Web Shell (opens in a new tab)
- MITRE ATT&CK T1204.002: User Execution: Malicious File (opens in a new tab)
- MITRE ATT&CK T1547.004: Boot or Logon Autostart Execution: Winlogon Helper DLL (opens in a new tab)
- Microsoft Learn: MSGina.dll Features, Userinit.exe activation (opens in a new tab)
- Ask the Performance Team blog: WS2008: Terminal Services Architecture (opens in a new tab)
- Microsoft Learn: RunOnce Request Types and Scenarios (Windows Embedded Standard 2009) (opens in a new tab)
- Elastic: Execution of Persistent Suspicious Program (opens in a new tab)
- Elastic: Suspicious Execution via Scheduled Task (opens in a new tab)
- Elastic: Unusual Parent-Child Relationship (opens in a new tab)
- Microsoft Learn: Provider Hosting and Security (opens in a new tab)
- Microsoft Learn: ActiveScriptEventConsumer class (opens in a new tab)
- Microsoft Learn: CommandLineEventConsumer class (opens in a new tab)
- SigmaHQ: WMI Persistence, Script Event Consumer (opens in a new tab)
- SigmaHQ: WMI Persistence, Command Line Event Consumer (opens in a new tab)
- SigmaHQ: WmiPrvSE Spawned A Process (opens in a new tab)
- Velociraptor: Windows.Detection.WMIProcessCreation (opens in a new tab)
- Microsoft Learn: Installation and configuration for Windows Remote Management (opens in a new tab)
- Elastic: Incoming Execution via PowerShell Remoting (opens in a new tab)
- Elastic: Incoming Execution via WinRM Remote Shell (opens in a new tab)
- SigmaHQ: Remote PowerShell Session Host Process (WinRM) (opens in a new tab)
- Elastic: Incoming DCOM Lateral Movement with MMC (opens in a new tab)
- Elastic: Incoming DCOM Lateral Movement with ShellBrowserWindow or ShellWindows (opens in a new tab)
- SigmaHQ: PsExec Service Installation (opens in a new tab)
- SigmaHQ: PsExec Tool Execution From Suspicious Locations, PipeName (opens in a new tab)
- Velociraptor: Windows.Detection.PsexecService (opens in a new tab)
- Elastic: Suspicious MS Office Child Process (opens in a new tab)
- Elastic: Web Shell Detection: Script Process Child of Common Web Processes (opens in a new tab)
- Microsoft Learn: Application Pool Identities (opens in a new tab)
- SigmaHQ: Sticky Key Like Backdoor Execution (opens in a new tab)
- Elastic: Potential Modification of Accessibility Binaries (opens in a new tab)