Process Metadata

Contextual data about a running process, which may include information such as environment variables, image name, user/owner, etc.

ID: DC0034
Domains: ICS, Mobile, Enterprise
Version: 2.0
Created: 20 October 2021
Last Modified: 21 October 2025

Log Sources

Name Channel
auditd:SYSCALL execve call for sudo where euid != uid
auditd:SYSCALL Use of fork/exec with DISPLAY unset or redirected
auditd:SYSCALL execve, prctl, or ptrace activity affecting process memory or command-line arguments
auditd:SYSCALL execve with UID ≠ EUID
auditd:SYSCALL execve with escalated privileges
AWS:CloudTrail cross-account or unexpected assume role
containerd:events Docker or containerd image pulls and process executions
EDR:hunting Correlation of signer info, parent-child lineage, rare invocation context (user host role), and API surfaces (CreateProcess*, LoadLibrary*)
EDR:Telemetry Process lineage and API usage enrichment (GetSystemTime, GetTimeZoneInformation, NtQuerySystemTime)
esxi:auth user session
esxi:hostd /var/log/hostd.log API calls reading/altering time/ntp settings
etw:Microsoft-Windows-ClickOnce provider: Event Tracing for Windows (ETW) events associated with ClickOnce deployment (dfsvc.exe activity)
etw:Microsoft-Windows-Kernel-Process process_start: EventHeader.ProcessId true parent vs reported PPID mismatch
linux:osquery Cross-reference argv[0] with actual executable path and parent process metadata
linux:osquery select: path LIKE '/dev/video%'
linux:osquery state=attached/debugged
linux:osquery process metadata mismatch between /proc and runtime attributes
linux:osquery process environment variables containing LD_PRELOAD
linux:syslog sudo or service accounts invoking loaders with suspicious env vars
linux:syslog Kernel or daemon warnings of downgraded TLS or cryptographic settings
macos:endpointsecurity ES_EVENT_TYPE_NOTIFY_EXEC, ES_EVENT_TYPE_NOTIFY_MMAP
macos:osquery Process Context
macos:osquery Process Execution + Hash
macos:unifiedlog subsystem=com.apple.process
macos:unifiedlog subsystem=com.apple.TCC
macos:unifiedlog exec of binary with setuid/setgid and EUID != UID
macos:unifiedlog process
macos:unifiedlog Code Execution & Entitlement Access
macos:unifiedlog Process opening SSH_AUTH_SOCK or /tmp/ssh-* socket not owned by same UID
macos:unifiedlog code signature/memory protection
macos:unifiedlog log collect from launchd and process start
macos:unifiedlog Modifications or writes to EFI system partition for downgraded bootloaders
macos:unifiedlog non-shell process tree accessing bash history
networkdevice:syslog Admin activity
Process None
WinEventLog:AppLocker AppLocker audit/blocks showing developer utilities executing scripts/binaries outside policy
WinEventLog:Microsoft-Windows-CodeIntegrity/Operational CodeIntegrity/WDAC events indicating unsigned/invalid DLL loads
WinEventLog:Microsoft-Windows-CodeIntegrity/Operational Unsigned/invalid signature modules or images loaded by msbuild.exe or its children
WinEventLog:Microsoft-Windows-CodeIntegrity/Operational Unsigned or untrusted modules loaded during JamPlus.exe runtime
WinEventLog:Microsoft-Windows-DeviceGuard/Operational WDAC policy audit/block affecting msbuild.exe spawned payloads
WinEventLog:Microsoft-Windows-Security-Mitigations/KernelMode ETW telemetry indicating ClickOnce deployment (dfsvc.exe) launching payloads
WinEventLog:Microsoft-Windows-SmartAppControl/Operational Smart App Control decisions (audit/block) for msbuild.exe-launched executables
WinEventLog:Microsoft-Windows-Windows Camera Frame Server/Operational Process session start/stop events for camera pipeline by unexpected executables
WinEventLog:PowerShell EventCode=400,403

Detection Strategy

ID Name Technique Detected
DET0455 Abuse of PowerShell for Arbitrary Execution T1059.001
DET0489 Behavior-chain detection for T1134.004 Access Token Manipulation: Parent PID Spoofing (Windows) T1134.004
DET0556 Behavior-chain detection strategy for T1127.001 Trusted Developer Utilities Proxy Execution: MSBuild (Windows) T1127.001
DET0191 Behavior-chain detection strategy for T1127.002 Trusted Developer Utilities Proxy Execution: ClickOnce (Windows) T1127.002
DET0585 Behavior-chain detection strategy for T1127.003 Trusted Developer Utilities Proxy Execution: JamPlus (Windows) T1127.003
DET0151 Behavior-chain, platform-aware detection strategy for T1124 System Time Discovery T1124
DET0197 Behavior-chain, platform-aware detection strategy for T1125 Video Capture T1125
DET0172 Behavior-chain, platform-aware detection strategy for T1127 Trusted Developer Utilities Proxy Execution (Windows) T1127
DET0018 Behavior-chain, platform-aware detection strategy for T1129 Shared Modules T1129
DET0102 Behavioral Detection of Input Capture Across Platforms T1056
DET0089 Behavioral Detection of Keylogging Activity Across Platforms T1056.001
DET0127 Behavioral Detection of Masquerading Across Platforms via Metadata and Execution Discrepancy T1036
DET0508 Behavioral Detection of Process Injection Across Platforms T1055
DET0052 Behavioral Detection Strategy for Abuse of Sudo and Sudo Caching T1548.003
DET0234 Credential Dumping via Sensitive Memory and Registry Access Correlation T1003
DET0385 Detect Access and Parsing of .bash_history Files for Credential Harvesting T1552.003
DET0350 Detecting Downgrade Attacks T1562.010
DET0470 Detecting Protocol or Service Impersonation via Anomalous TLS, HTTP Header, and Port Mismatch Correlation T1001.003
DET0034 Detection of Adversarial Process Discovery Behavior T1057
DET0655 Detection of Command and Scripting Interpreter T1623
DET0722 Detection of Hooking T0874
DET0725 Detection of Masquerading T0849
DET0735 Detection of Scripting T0853
DET0607 Detection of Unix Shell T1623.001
DET0345 Detection Strategy for Abuse Elevation Control Mechanism (T1548) T1548
DET0428 Detection Strategy for Bind Mounts on Linux T1564.013
DET0128 Detection Strategy for Hidden Windows T1564.003
DET0435 Detection Strategy for Hijack Execution Flow: Dynamic Linker Hijacking T1574.006
DET0347 Detection Strategy for Masquerading via Legitimate Resource Name or Location T1036.005
DET0164 Detection Strategy for Overwritten Process Arguments Masquerading T1036.011
DET0324 Detection Strategy for Polymorphic Code Mutation and Execution T1027.014
DET0203 Detection Strategy for Ptrace-Based Process Injection on Linux T1055.008
DET0256 Detection Strategy for SSH Session Hijacking T1563.001
DET0005 Renamed Legitimate Utility Execution with Metadata Mismatch and Suspicious Path T1036.003
DET0110 Setuid/Setgid Privilege Abuse Detection (Linux/macOS) T1548.001