🛡️ Security

Process Lineage

The parent-child chain of processes on a host, showing which process launched which. Hunting on lineage catches exploitation because compromised services spawn children they never would in normal operation.

📚 Deep Dive

Learn Article

Hunting for Compromise Before the Vendor Publishes Indicators

A vendor says a flaw is exploited but has no IoC list yet. You can still hunt. Here is a method built on process lineage, log integrity, and behavioral baselines that works with zero curated indicators.

intermediate 5 min read

Back to Glossary