Read a process tree you built on purpose

short · 50 min · Objective 1.2

Task

Create the parent-child process relationships that host detections fire on, then find them in the telemetry by shape rather than by name. Nothing here is malicious: every process is a built-in tool you launched yourself.

Steps

  1. From a normal command prompt on the Windows VM, run whoami, net user, ipconfig /all and systeminfo in quick succession. This is what discovery looks like, performed by you.
  2. Now build an unusual parentage deliberately. Open Word or WordPad, and from it launch a command prompt if your configuration allows; otherwise use wmic process call create "cmd.exe /c whoami" so the parent is WmiPrvSE.
  3. Run an encoded PowerShell command that does something harmless: powershell -EncodedCommand followed by the base64 of Write-Output hi. You are producing the shape of an evasion, not an evasion.
  4. Create persistence and remove it again: add a Run key pointing at notepad.exe, confirm it, then delete it.
  5. At the collector, find all four. For each, write down the single field that made it findable, and whether that field would still exist if the attacker renamed their binary.

Verify

powershell -c "Get-WinEvent -FilterHashtable @{LogName='Security';Id=4688} -MaxEvents 200 | Where-Object {$_.Message -match 'whoami'} | Measure-Object | Select-Object -Expand Count"
powershell -c "Get-WinEvent -FilterHashtable @{LogName='Security';Id=4688} -MaxEvents 200 | Where-Object {$_.Message -match 'EncodedCommand'} | Measure-Object | Select-Object -Expand Count"
powershell -c "Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational';Id=1} -MaxEvents 200 | Where-Object {$_.Message -match 'ParentImage.*WmiPrvSE'} | Measure-Object | Select-Object -Expand Count"

All three must be non-zero. If the first is zero, command-line capture is off and 4688 is telling you a process ran without telling you what it did -- which is the default, and the single most common telemetry gap on Windows.

Notes

The EncodedCommand detection is a technique-level rule: it survives renaming the binary, because the encoding is a property of how PowerShell is being invoked. The whoami detection is procedure-level and does not.

Rank your four fields by where they sit on the pyramid of pain. That ranking is the one the exam asks about, and it is much easier to remember once you have watched each field appear.

This is an independent study companion for CompTIA CySA+ CS0-004 and is not produced by or endorsed by CompTIA.