Process Creation

Refers to the event in which a new process (executable) is initialized by an operating system. This can involve parent-child process relationships, process arguments, and environmental variables. Monitoring process creation is crucial for detecting malicious behaviors, such as execution of unauthorized binaries, scripting abuse, or privilege escalation attempts.

Data Collection Measures:

• Endpoint Detection and Response (EDR) Tools:
  • EDRs provide process telemetry, tracking execution flows and arguments.
• Windows Event Logs:
  • Event ID 4688 (Audit Process Creation): Captures process creation with associated parent process.
• Sysmon (Windows):
  • Event ID 1 (Process Creation): Provides detailed logging
• Linux/macOS Monitoring:
  • AuditD (execve syscall): Logs process creation.
  • eBPF/XDP: Used for low-level monitoring of system calls related to process execution.
  • OSQuery: Allows SQL-like queries to track process events (process_events table).
  • Apple Endpoint Security Framework (ESF): Monitors process creation on macOS.
• Network-Based Monitoring:
  • Zeek (Bro) Logs: Captures network-based process execution related to remote shells.
  • Syslog/OSSEC: Tracks execution of processes on distributed systems.
• Behavioral SIEM Rules:
  • Monitor process creation for uncommon binaries in user directories.
  • Detect processes with suspicious command-line arguments.