After narrowing the list of suspicious events, click any row in the grid to open the Record Details panel. This view provides all recorded details for the selected process event. Key fields to analyze include:
Process path and arguments: The full path to the executable and the command-line arguments it was launched with. Arguments indicate the process's true intent, such as encoded PowerShell commands or URLs for C2 communication.
User and Hostname: Who executed the process and on which machine.
PID and Parent PID: The Process ID and its parent's ID are used to trace the execution chain.
MD5: The file hash, which you can use to pivot to external threat intelligence platforms such as VirusTotal.
First Seen / Event At: Timestamps that help establish a timeline of activity.
Endpoint Detection and Response with Forensics (EDRF) > Investigate potential threats with EDRF > Analyzing forensic data > Analyze forensic data using HX modules > Evaluate events to detect malicious processes with Process Tracker