To understand the origin of a malicious process, you can reconstruct the sequence of events by tracing parent-child process relationships in Process Tracker.
Using the Sequential view
You can manually build the execution timeline using the process grid and the details panel.
Start with the Suspicious Process: After you identify a potentially malicious process (for example,
powershell.exe), note its PID and Parent PID from the Record Details.Find the Parent: Clear your current filters. Create a new filter where the PID is equal to the Parent PID you just noted. This action reveals the process that launched your initial suspicious process (for example, cmd.exe).
Walk Up the Chain: Analyze this new parent process. Note its Parent PID and repeat these steps. Walking backward up the chain allows you to trace the activity to its root cause — for example, a user clicking a malicious document (
winword.exe), a scheduled task (taskhostw.exe), or another compromised process. This technique provides definitive evidence of how an attacker moved through the system.