Module 5 — Processes, Threads, and Handles

Summary

A process is a container: virtual memory, token, handles, loaded DLLs, threads. Security investigations pivot on parent/child, integrity, signer, and unexpected modules.

Path: Module 4 · Next: Module 6

0. Purpose

Alerts name processes (powershell.exe, mshta.exe, MsMpEng.exe). You must read PID, parent, command line, user, integrity, image path, loaded DLLs as one story.

1. ELI5

A process is a running program instance:

Memory map — its own address space (mostly)
Identity badge — access token (who am I, admin or not?)
Toolbox — handles to files, registry keys, other processes
Workers — threads doing the actual CPU work
Backpack — DLLs snapped in at runtime

explorer.exe is the desktop shell; MsMpEng.exe is Defender scanning — same OS, different jobs.

2. Deep breakdown

flowchart TB
  PROC[Process]
  PROC --> TOKEN[Access token
SID, groups, integrity]
  PROC --> VAD[Virtual memory
images, heap, stack]
  PROC --> MOD[Loaded modules
exe + DLLs]
  PROC --> THR[Threads]
  PROC --> HND[Handles
files, keys, processes]
  PROC --> PEB[PEB
loader metadata]

Field	Meaning	Hunt signal
Image path	Executable on disk	Masquerade (`svchost.exe` from `Users\`)
Parent PID	Who created this process	Office → PowerShell = suspicious
Command line	Args	Encoded commands, LOLBins
User / SID	Token subject	Service account vs interactive
Integrity level	Low / Medium / High / System	UAC boundaries
Session ID	Console vs RDP	Lateral movement context

Key system processes (know by sight)

Process	Role
`System`	Kernel pseudo-process
`smss.exe`	Session manager
`csrss.exe`	Win32 subsystem
`wininit.exe` / `services.exe`	Service Control Manager bootstrap
`lsass.exe`	Auth secrets / policy (protect fiercely)
`svchost.exe`	Shared service host — check service group
`explorer.exe`	Shell
`MsMpEng.exe`	Defender engine

On lab .114, top memory consumers observed 2026-09-01: MsMpEng, explorer, TiWorker, TextInputHost, msedge.

PEB / loader (investigator depth)

The Process Environment Block lists loaded modules and command line in memory — see PEB / TEB.

Integrity levels (UAC boundary)

Level	Typical processes	Implication
Low	Protected Mode IE/Edge renderer	Sandboxed
Medium	Standard user apps	Default interactive
High	Elevated admin	UAC-approved
System	`services.exe`, `lsass.exe`	OS core — protect fiercely

`lsass.exe` — identity broker

lsass.exe hosts LSA security packages (NTLM, Kerberos, CloudAP). Deep dive: Module 10 — LSASS & identity.

On .114, LSASS listens in the 49664 ephemeral RPC range alongside SMB 445 and RPC 135 — keep lab on isolated VLAN.

Sysmon Event IDs (when installed)

ID	Name	Hunt focus
1	Process Create	Parent chain, CLI, hashes
7	Image Loaded	DLL injection, unusual modules
10	Process Access	`OpenProcess` to LSASS
3	Network Connection	Egress / lateral movement
11	FileCreate	Staging in `%TEMP%`

Lab .114 has Sysmon — see Lab tools inventory.

Security engineer lens

Telemetry	What it gives you
Sysmon 1	Process create + parent + hashes
Sysmon 7	Image (DLL) load
Sysmon 10	Process access (OpenProcess)
4688 (Security)	Process creation (if auditing on)
Process Explorer	Live modules, handles, token tab

Question chain: Who spawned it? → What DLLs loaded? → What handles to other processes? → Signed?

Lab checkpoint — `192.168.50.114`

# Snapshot running processes
Get-Process |
  Sort-Object WorkingSet -Descending |
  Select-Object -First 12 Name, Id,
    @{N='WS_MB';E={[math]::Round($_.WorkingSet64/1MB,1)}},
    Path |
  Format-Table -AutoSize

# Parent/child for PowerShell (needs CIM)
Get-CimInstance Win32_Process -Filter "Name='powershell.exe'" |
  Select-Object ProcessId, ParentProcessId, CommandLine

# Resolve parent name
$p = Get-CimInstance Win32_Process -Filter "ProcessId=$PID"
$parent = Get-CimInstance Win32_Process -Filter "ProcessId=$($p.ParentProcessId)"
[PSCustomObject]@{ Child='powershell'; Parent=$parent.Name; ParentPid=$parent.ProcessId }

# Modules in this shell
Get-Process -Id $PID -Module | Where-Object ModuleName -match 'amsi|ntdll|kernel' |
  Select-Object ModuleName, FileName

Record in notebook

Five system processes and one-line roles
Parent of your lab PowerShell session on .114
Screenshot or table: top 5 processes by memory

← Module 4 · Module 6 →