Malware › Module 7 › Lesson 3
Process Tree
Process tree literacy — parent-child graph from $MAL_LAB detonation mapped to MITRE execution and persistence categories.
Visual · t22_process_tree
Process tree = spawn graph from sample root. $MAL_LAB. Original Cyberlium.
Opening
Malware rarely runs alone — draw the tree from your lab detonation so defenders know which branch to kill.
Process tree analysis builds a graph: sample process as root or entry child, spawned interpreters (cmd.exe, powershell.exe, wscript.exe), injected or hollowed targets at literacy level, service creation branches. Map nodes to ATT&CK execution and persistence categories — T1059 scripting, T1547 autostart attempts, T1055 concepts named not weaponized. Use $MAL_LAB proc monitor export — UTC ordered, PIDs labeled, command lines redacted. Cyberlium teaches tree drawing for detection and report handoff — NOT process injection tutorials for offense, NOT hollowed explorer.exe recipes on host OS, NOT hiding trees by disabling logging. One suspicious branch → one detection hypothesis for blue.
1. Building the tree
Start at sample execution PID; add children by Parent PID links; mark terminated nodes if logged.
Flag LOLBin spawns: script hosts, rundll32, mshta — detection angles not cookbooks.
Command guide
Try these commands — Building the tree
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Process triage — https://malwareunicorn.org/workshops/malwareanalysis101.html (running processes literacy) ANY.RUN process tree — https://any.run/ (dynamic process literacy from reports)
═══ INSTALL ═══
Linux (Debian/Ubuntu): Built-in (iproute2)
macOS: Use: netstat
Windows: Use: netstat
═══ LINUX / macOS ═══
Command — copy this
source "$HOME/cyberlium-lab/t22-mal/lab.env" 2>/dev/null || true ps aux 2>/dev/null | head -15 ps aux 2>/dev/null | grep -E 'PID|python|sshd' | head -8
Primary tools to practice this lesson: ss. Reference sites: Process triage (https://malwareunicorn.org/workshops/malwareanalysis101.html); ANY.RUN process tree (https://any.run/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. ATT&CK mapping
Each node gets technique category if evidenced: Execution, Persistence, Defense Evasion (literacy).
Honest N/A if brief sample only drops file without spawn — do not invent branches.
3. Defender handoff
Export tree as diagram or indented list — redact user paths; link to dynamic lab pack ID.
Purple question: which node would EDR kill first on $MAL_LAB replay?
4. What you ship: process tree diagram
Spawn graph ≥5 nodes + ATT&CK tags + one detection hypothesis — redacted.
5. What you record before the next lesson
Process tree diagram path.
6. Wrong vs right: live malware on daily driver vs sandbox
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Write process injection tutorial from lab tree for public offense forum.
Right
Process tree from $MAL_LAB detonation. Next: Net/Proc Lab.
Mission: process tree diagram
1) Build tree from proc export. 2) Label ≥5 nodes with PID and name. 3) Tag ATT&CK categories evidenced. 4) One detection hypothesis for blue.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Orphan PID — how to note honestly?”
Knowledge Check
APPLY: Process tree built from:
Multiple choice
Knowledge Check
APPLY: True or False: Publish injection cookbook from tree.
True or False
Knowledge Check
APPLY: LOLBin spawn in tree means:
Multiple choice