Running Processes and Modules

Overview

Evidence: Running Processes and Modules
Description: Collect running processes and modules list
Category: System
Platform: windows
Short Name: pri
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No

Background

Windows processes are instances of executing programs. Each process has its own virtual memory space, security context, and system resources. Understanding running processes is fundamental to incident response and threat hunting.

The Process Environment Block (PEB) contains important process information including command line arguments, loaded modules, and environment variables. Windows maintains detailed information about each process including creation time, parent-child relationships, and security identifiers.

Data Collected

This collector gathers structured data about running processes and modules.

Running Processes and Modules Data

Field	Description	Example
ProcessID	Process identifier	1234
ParentID	Parent process identifier	5678
SessionID	Session identifier	1
Object	Kernel object address	0xFFFF8A8012345678
PEB	Process Environment Block address	0x000000007FFD0000
BaseAddress	Base address of the process image	0x00007FF6ABC00000
CreationTime	Process creation timestamp	2023-10-15T14:30:00
Is32Bit	Whether process is 32-bit	TRUE/FALSE
SID	Security identifier	S-1-5-21-…
Username	User account name	DOMAIN\user
Name	Process name	chrome.exe
CommandLine	Full command line	”C:\Program Files\Chrome\chrome.exe” —type=renderer
ProcessPath	Full path to executable	C:\Program Files\Chrome\chrome.exe
BasePriority	Process base priority	8
IsVirtualProcess	Whether process is virtual	FALSE
ProcessRowID	Foreign key to process	1
DllPath	Path to loaded module	C:\Windows\System32\kernel32.dll
DllBase	Base address where DLL is loaded	0x00007FFE12340000
EntryPoint	DLL entry point address	0x00007FFE12341000
SizeOfImage	Size of the loaded image	524288
LoadCount	Module load count	1
ProcessRowID	Foreign key to process	1
ThreadID	Thread identifier	9876
Win32StartAddress	Win32 start address	0x00007FF6ABC12340
StartAddress	Kernel start address	0x00007FF6ABC12340
CreateTime	Thread creation timestamp	2023-10-15T14:30:05
StackBase	Stack base address	0x0000001234560000
StackLimit	Stack limit address	0x0000001234520000
State	Thread state	5
WaitReason	Reason for waiting	0
BasePriority	Thread base priority	8
Priority	Current priority	8
ProcessRowID	Foreign key to process	1
Handle	Handle value	0x1234
HandleType	Type of object	File
HandleName	Name or path of object	\Device\HarddiskVolume3\Windows\System32\kernel32.dll
HandleAccess	Access rights	0x12019F
HandleAttributes	Handle attributes	0
HandleObject	Kernel object address	0xFFFF8A8012345678
ProcessRowID	Foreign key to process	1

Collection Method

This collector uses a kernel driver to enumerate running processes and gather detailed information including:

• Process list from kernel
• Detailed process information via IOCTL calls
• Module enumeration from PEB
• Thread enumeration
• Handle enumeration
• Command line parsing to extract file paths

Forensic Value

Process information is fundamental for incident response and threat hunting. Investigators use this data to identify malicious processes, detect process injection, analyze parent-child relationships, identify suspicious command lines, track loaded DLLs, detect thread injection, enumerate open handles to files and registry keys, and establish process execution timelines. This evidence is particularly valuable for detecting living-off-the-land attacks, fileless malware, and process manipulation techniques.