How to Investigate Suspicious Process Activity on Windows

The most revealing aspect of a suspicious process is how it was created: what launched it, with what arguments, and under what user account.

Via Windows Event Log (requires 'Audit Process Creation' + command-line logging policy):

# Enable command-line logging if not already enabled
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit' -Name ProcessCreationIncludeCmdLine_Enabled -Value 1

# Find process creation events for a specific process
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688} |
    Where-Object { $_.Message -match 'powershell.exe' } |
    Select-Object TimeCreated, @{N='ProcessName';E={$_.Properties[5].Value}},
                              @{N='CommandLine';E={$_.Properties[8].Value}},
                              @{N='ParentProcess';E={$_.Properties[13].Value}},
                              @{N='User';E={$_.Properties[1].Value}} |
    Sort-Object TimeCreated -Descending | Select-Object -First 20

Via Sysmon (Event ID 1: process creation): Sysmon provides more detail than native event logging:

# Query Sysmon process creation events
Get-WinEvent -LogName 'Microsoft-Windows-Sysmon/Operational' -FilterXPath "*[System[EventID=1] and EventData[Data[@Name='Image'] and (Data='C:\Windows\System32\powershell.exe')]]" |
    ForEach-Object {
        $xml = [xml]$_.ToXml()
        [PSCustomObject]@{
            TimeCreated = $_.TimeCreated
            Image = $xml.Event.EventData.Data | Where-Object Name -eq 'Image' | Select-Object -ExpandProperty '#text'
            CommandLine = $xml.Event.EventData.Data | Where-Object Name -eq 'CommandLine' | Select-Object -ExpandProperty '#text'
            ParentImage = $xml.Event.EventData.Data | Where-Object Name -eq 'ParentImage' | Select-Object -ExpandProperty '#text'
            ParentCommandLine = $xml.Event.EventData.Data | Where-Object Name -eq 'ParentCommandLine' | Select-Object -ExpandProperty '#text'
            User = $xml.Event.EventData.Data | Where-Object Name -eq 'User' | Select-Object -ExpandProperty '#text'
            Hashes = $xml.Event.EventData.Data | Where-Object Name -eq 'Hashes' | Select-Object -ExpandProperty '#text'
        }
    }

High-suspicion parent-child combinations:

• Word.exe / Excel.exe spawning powershell.exe, cmd.exe, or wscript.exe (macro execution)
• browser process spawning cmd.exe or powershell.exe (browser exploit)
• services.exe spawning cmd.exe with an encoded command line (service-based persistence)
• msiexec.exe spawning cmd.exe (malicious installer)
• Any process spawning certutil.exe, mshta.exe, regsvr32.exe, or bitsadmin.exe with network arguments

For a live system, Sysinternals tools provide immediate visibility.

Process Explorer: the first tool to open:

Download: https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer
Run as Administrator

Process Explorer shows the full process tree, CPU/memory usage, and the DLLs loaded by each process. Right-click any process > Properties > Strings tab to see embedded strings (URLs, IP addresses, file paths).

Configure VirusTotal integration: Options > VirusTotal.com > Check VirusTotal.com. This checks each process's hash against VirusTotal: processes with positive detections appear highlighted in red.

Key indicators in Process Explorer:

• Process without a parent (orphaned): suggests the parent was killed or the process was launched by malware that terminated itself
• Process running from a temp directory (%TEMP%, %APPDATA%, C:\Windows\Temp): highly suspicious
• Two processes with the same name but one has a different path (svchost.exe not in C:\Windows\System32 is always suspicious)
• Process with a VirusTotal positive count > 0

Process Monitor: what the process is doing:

Download: https://learn.microsoft.com/en-us/sysinternals/downloads/procmon
Run as Administrator

Process Monitor captures all file system, registry, and network activity in real time. To investigate a specific process:

1. Filter > Add Filter > Process Name > is > suspicious.exe > Include
2. Look for: file writes to startup locations (HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup), network connection events, reads of credential stores

Autoruns: persistence discovery:

Download: https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns
Run as Administrator with VirusTotal integration enabled (Options > Scan Options > Check VirusTotal.com)

Autoruns shows every startup location and mechanism in Windows. Malware persistence is highlighted by VirusTotal hits or entries in unusual locations. Sort by 'Image Not Found' (deleted persistence that still has a registry entry) and 'Entry Date' (recently created entries).

After understanding the process, identify its network activity.

Current connections (live system):

# All current network connections with process names and PIDs
Get-NetTCPConnection -State Established |
    Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort,
                  @{N='Process';E={(Get-Process -Id $_.OwningProcess).ProcessName}}, OwningProcess |
    Where-Object { $_.RemoteAddress -notmatch '^(127\.|10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.)' } |
    Sort-Object Process

# Or with netstat (includes process names)
netstat -b -n -o

Historical network connections from Sysmon (Event ID 3: network connection):

$startTime = (Get-Date).AddHours(-24)
Get-WinEvent -LogName 'Microsoft-Windows-Sysmon/Operational' -FilterXPath "*[System[EventID=3 and TimeCreated[@SystemTime>='$($startTime.ToUniversalTime().ToString("o"))')]]" |
    ForEach-Object {
        $xml = [xml]$_.ToXml()
        [PSCustomObject]@{
            TimeCreated = $_.TimeCreated
            Image = ($xml.Event.EventData.Data | Where-Object Name -eq 'Image').'#text'
            DestinationIp = ($xml.Event.EventData.Data | Where-Object Name -eq 'DestinationIp').'#text'
            DestinationPort = ($xml.Event.EventData.Data | Where-Object Name -eq 'DestinationPort').'#text'
            DestinationHostname = ($xml.Event.EventData.Data | Where-Object Name -eq 'DestinationHostname').'#text'
        }
    } | Where-Object { $_.Image -match 'suspicious|powershell|cmd' }

Threat intelligence lookup on discovered IPs:

# Quick VirusTotal lookup via API (requires free API key)
$ip = '1.2.3.4'
$apiKey = $env:VT_API_KEY
Invoke-RestMethod -Uri "https://www.virustotal.com/api/v3/ip_addresses/$ip" -Headers @{'x-apikey'=$apiKey} |
    Select-Object -ExpandProperty data | Select-Object -ExpandProperty attributes |
    Select-Object last_analysis_stats, reputation

After identifying what the suspicious process did, determine how far the compromise extends.

Check for additional compromised systems using SIEM correlation:

// Microsoft Sentinel: find all systems where the same process hash was seen
DeviceProcessEvents
| where SHA256 == "<hash_of_suspicious_process>"
| distinct DeviceName, AccountName, FileName, ProcessCommandLine
| sort by DeviceName asc

Check for lateral movement from the compromised host:

// Network connections from the compromised host in the compromise window
DeviceNetworkEvents
| where DeviceName == "COMPROMISED-WORKSTATION"
| where Timestamp > datetime(2026-06-26T10:00:00) and Timestamp < datetime(2026-06-26T14:00:00)
| where RemoteIPType != "Private"
| project Timestamp, RemoteIP, RemotePort, RemoteUrl, InitiatingProcessFileName
| sort by Timestamp asc

Document and contain:

1. Collect the process image (binary), parent process image, and any dropped files for malware analysis
2. Preserve the process memory if live forensics is required: procdump -ma <PID> process.dmp
3. Isolate the endpoint (EDR isolation, or network disconnect)
4. Report findings: hash of malicious binary, C2 IPs/domains, persistence mechanism found, user account involved, first-seen timestamp
5. Hunt for the same indicators across all other endpoints in your environment