Skip to main content

Parent-Child Execution

Atlas home · Research path · Operational families · Anomaly models · Visual index

Consolidated 27 September 2026 from the revised publication. Source-reported incidents, proposed models, functional tests, and synthetic results remain separate evidence classes. Provenance and review scope.

An unusual direct process relationship or explicitly defined ancestry path.

Telemetry contract: Stable process identifiers, parent identifiers, command lines, user and asset role.

Candidate method [unvalidated until tested]: Specify direct child versus ancestor matching and test process-ID reuse and incomplete ancestry.

Benign alternatives and limits: Application automation can launch shells; in-process activity can evade child-process rules.

Parent–child execution anomaly. In the synthetic w3wp.exe → cmd.exe → powershell.exe chain, cmd.exe is the web worker’s direct child; PowerShell is its later descendant and cmd.exe’s direct child. This is not a reconstruction of the Exchange incidents below. PID reuse, missing ancestry and in-process execution limit coverage.
Figure 16. Parent–child execution anomaly. In the synthetic w3wp.exe → cmd.exe → powershell.exe chain, cmd.exe is the web worker’s direct child; PowerShell is its later descendant and cmd.exe’s direct child. This is not a reconstruction of the Exchange incidents below.SYNTHETIC ILLUSTRATION · USER-SUPPLIEDSources: NIST SP 800-94.
Text equivalent and full-size diagram

PID reuse, missing ancestry and in-process execution limit coverage.

Direct relationship 1: w3wp.exe starts cmd.exe. Direct relationship 2: cmd.exe starts powershell.exe.

Relative to w3wp.exe, PowerShell is a descendant, not a direct child.

Use stable process identifiers, host role and command lines. Verify legitimate automation; in-process activity may create no child process.

Open original full-size asset

Evidence tags: Endpoint telemetry. Statistical forms: contextual, collective.

Browse articles and guides: Parent-Child Execution.

Reported incidents and detection interpretations

Lemon Duck exploitation of Exchange servers​

Period: March 2021 reporting. Evidence: campaign reported by the cited source.

Observed [source-reported]: Microsoft associated Exchange IIS-worker spawning of PowerShell with observed Lemon Duck activity and supplied a corresponding hunting query. Microsoft: Analyzing attacks taking advantage of the Exchange Server vulnerabilities.

Anomaly interpretation [inferred]: Investigate w3wp.exe to powershell.exe lineage in the Exchange context, then inspect the command, deployment history and network activity.

Telemetry to validate: MDE DeviceProcessEvents or equivalent parent/child process events with command lines.

Boundary / competing explanation: Microsoft's query is a hunting starting point, not proof that every matching parent-child pair is malicious.

ATT&CK [author-mapped behavior, not actor attribution]: T1059.001 — Command and Scripting Interpreter: PowerShell

DoejoCrypt activity after Exchange exploitation​

Period: March 2021 reporting. Evidence: campaign reported by the cited source.

Observed [source-reported]: Microsoft described DoejoCrypt-associated batch-script credential theft and published lineage-oriented queries for post-exploitation activity. Microsoft: Analyzing attacks taking advantage of the Exchange Server vulnerabilities.

Anomaly interpretation [inferred]: Follow the web-server, command-shell and credential-access chain instead of alerting on cmd.exe globally. Corroborate with script content and resulting files.

Telemetry to validate: Process ancestry, batch command lines, sensitive-registry access and file creation.

Boundary / competing explanation: The report covers several exploiting actors; do not attribute every Exchange child process to HAFNIUM or DoejoCrypt.

ATT&CK [author-mapped behavior, not actor attribution]: T1059.003 — Command and Scripting Interpreter: Windows Command Shell

Crosslinks: Rare Process / Service · Sequence. Statistical foundation in the Anomaly Detection Atlas. Related research: Newest Detection Engineering Techniques: From Rules to Validated Security Telemetry.

Illustrative scenarios (not additional incidents):

  • winword.exe spawns powershell.exe, even though Office applications on that workstation normally never launch script interpreters.

  • w3wp.exe (IIS worker process) starts cmd.exe, an uncommon parent-child relationship that can indicate web shell activity.

  • excel.exe launches rundll32.exe and then a network connection follows, which is not part of normal spreadsheet usage.

  • An SSH session has curl or wget in its descendant process tree, although such downloads are unusual for the host role. A shell may be the direct parent; record actual ancestry instead of assuming sshd is the direct parent.

  • A business application service suddenly spawns 7z.exe or rar.exe, an unusual child process for that parent and host role.

Apply this analytical view​

These are curated conceptual links, not claims that a specific model detected the cited incidents.

Models: PowerShell script, encoded content, or remote command execution · Trusted system binary launches unexpected content · Public-facing application exploitation · User opens delivered content followed by execution.

Collection references: Process Creation · Script Execution. These describe data components, not equivalent connectors or guaranteed fields.

Technique workspaces​

Follow the exact technique ID to source rules, associated tools, collection references, and documented lab candidates. A navigation association is not live validation.