Core Windows Processes
Task Manager
Task Manager is a built-in system utility in Microsoft Windows operating systems that provides
information about running applications, processes, and system performance.
It allows users to monitor the usage of system resources, such as CPU, memory, and disk, and manage running applications
and processes.
Users can use Task Manager to view detailed information about the performance of their computer, diagnose problems, and
terminate unresponsive applications or processes.
Let's briefly go over each column (excluding Name, of course):
Type - Each process falls into 1 of 3 categories (Apps, Background process, or Windows process).
Publisher - Think of this column as the name of the author of the program/file.
PID - This is known as the process identifier number. Windows assigns a unique process identifier each time a program
starts. If the same program has multiple running processes, each will have its unique process identifier (PID).
Process name - This is the file name of the process. In the above image, the file name for Task Manager is [Link].
Command line - The full command used to launch the process.
CPU - The amount of CPU (processing power) the process uses.
Memory - The amount of physical working memory utilized by the process.
Core Windows Processes 1
Image path name and Command line columns can quickly alert an analyst of any outliers with a given process.
In the below image, PID 384 is paired with a process named [Link], a Windows process, but if the Image path name or
Command line is not what it's expected to be, then we can perform a deeper analysis of this process.
⚠ Task Manager doesn't show a Parent-Child process view. That is where other utilities, such as Process Hacker
and Process Explorer, come to the rescue.
Aside from Task Manager, it would be best if you also familiarize yourself with the command-line equivalent of obtaining
information about the running processes on a Windows system: tasklist , Get-Process or ps (PowerShell), and wmic .
System
The official definition from Windows Internals 6th Edition:
"The System process (process ID 4) is the home for a special kind of thread that runs only in kernel mode a kernel-mode system
thread. System threads have all the attributes and contexts of regular user-mode threads (such as a hardware context, priority,
and so on) but are different in that they run only in kernel-mode executing code loaded in system space, whether that is in
[Link] or in any other loaded device driver. In addition, system threads don't have a user process address space and
hence must allocate any dynamic storage from operating system memory heaps, such as a paged or nonpaged pool."
Another General Definition
The System process is a fundamental component responsible for managing and coordinating system-level operations. It is a
kernel-level process that runs in the background and is essential for the proper functioning of the operating system.
The System process has a crucial role in managing system resources such as memory, processor time, and input/output
operations. It is also responsible for managing device drivers, handling interrupts, and managing system calls. In addition,
the System process is responsible for starting and stopping system services and processes, including critical system-level
services such as the Task Manager, Registry Editor, and Control Panel.
The System process is a vital part of the operating system, and it is always running in the background, even if no user is
logged in. It is identified in the Windows Task Manager as "System" or "System Idle Process" and is assigned a process ID
(PID) of 4 in Windows. The System process is also present in other operating systems, such as Unix/Linux, and has a similar
function.
Core Windows Processes 2
View the properties of the System on Process Explorer.
Image Path: N/A
Parent Process: None
Number of Instances: One
User Account: Local System
Start Time: At boot time
View the properties of the System on Process Hacker.
Image Path: C:\Windows\system32\[Link] (NT OS Kernel)
Core Windows Processes 3
Parent Process: System Idle Process (0)
What is unusual behaviour for this process?
A parent process (aside from System Idle Process (0))
Multiple instances of System. (Should only be one instance)
A different PID. (Remember that the PID will always be PID 4)
Not running in Session 0
System > [Link]
[Link](Session Manager Subsystem).
This process, also known as the Windows Session Manager, is responsible for creating new sessions. It is the first user-mode
process started by the kernel.
How it works
When you turn on your computer, a program called "[Link]" starts running. It is a very important program that starts other
important programs in your computer. [Link] first starts a program called "[Link]" and a program called "[Link]" in
Session 0. Session 0 is like a special room in your computer where only the operating system can go. Then, [Link] starts
two more programs called "[Link]" and "[Link]" in Session 1. Session 1 is like a different room in your computer
where the user can go.
The first "[Link]" and "[Link]" programs that [Link] starts then create more programs in new sessions. To do
this, [Link] makes a copy of itself and starts running the copy in the new session. Once the copy of [Link] is running,
the original [Link] program stops running.
In summary, [Link] is an important program that starts other important programs when you turn on your computer. It starts
some programs in a special room in your computer where only the operating system can go, and other programs in a
different room where the user can go. The first programs it starts then make more programs in new rooms.
Why it does so?
[Link] is a critical system process that is responsible for starting the Windows subsystem and other system processes
during the boot process. It is the first user-mode process to start after the kernel loads, and its main purpose is to create and
initialize the Session Manager Subsystem (smss), which is responsible for managing user sessions and launching system
services.
When [Link] starts the Windows subsystem and other system processes in Session 0, it ensures that these processes
are isolated from user sessions to prevent unauthorized access or interference. This is because Session 0 is a highly
privileged session that is only accessible by system processes and services, whereas Session 1 and above are user
sessions that are accessible by logged-in users.
By starting [Link] and [Link] in Session 0, [Link] ensures that they have the necessary privileges and resources
to perform critical system functions, such as managing system services, drivers, and user sessions. Similarly, by starting
[Link] and [Link] in Session 1, [Link] ensures that they can interact with the user and manage user sessions
and logins.
Overall, [Link] starts these processes in different sessions to ensure that the operating system and user sessions are
properly isolated and managed, and that critical system functions can be performed securely and efficiently.
Core Windows Processes 4
Session 0 ([Link] & [Link])
Session 1 ([Link] & [Link])
What is normal?
Image Path: %SystemRoot%\System32\[Link]
Parent Process: System
Number of Instances: One master instance and child instance per session. The child instance exits after creating the session.
User Account: Local System
Start Time: Within seconds of boot time for the master instance
What is unusual?
A different parent process other than System (4)
The image path is different from C:\Windows\System32
More than one running process. (children self-terminate and exit after each new session)
Core Windows Processes 5
The running User is not the SYSTEM user
Unexpected registry entries for Subsystem
Differentiate between the responsibilities of the System process and the [Link] process in
Windows OS.
Process Responsibilities
- Manages system resources such as memory, CPU, and I/O
System process
devices
- Provides a runtime environment for system services and
applications
- Handles system-level interrupts and system calls
- Launches and terminates user-mode processes and system
services
- Maintains system security and stability
- Monitors system performance and generates system alerts or error
messages
- Manages power management and system settings
- Starts the Windows subsystem and other system processes during
[Link]
boot
- Creates and initializes the Session Manager Subsystem (smss)
- Manages user sessions and launches system services
- Interacts with the Winlogon process to manage user sessions and
logins
- Starts any other subsystem listed in the Required value of
Subsystems
- Ensures that critical system functions are performed securely and
efficiently
[Link]
[Link] (Client Server Runtime Process) is the user-mode side of the Windows subsystem.
This process is responsible for the Win32 console window and process thread creation and deletion.
For each instance, [Link], [Link], and [Link] are loaded (along with others).
This process is also responsible for making the Windows API available to other processes, mapping drive letters, and
handling the Windows shutdown process. You can read more about this process here.
What is normal?
Session 0 (PID 392)
Core Windows Processes 6
Session 1 (PID 512)
Notice what is shown for the parent process for these two processes. Remember, these processes are spawned by [Link],
which self-terminates itself.
Image Path: %SystemRoot%\System32\[Link]
Parent Process: Created by an instance of [Link]
Number of Instances: Two or more
User Account: Local System
Start Time: Within seconds of boot time for the first two instances (for Session 0 and 1). Start times for additional instances
occur as new sessions are created, although only Sessions 0 and 1 are often created.
What is unusual?
An actual parent process. ([Link] calls this process and self-terminates)
Image file path other than C:\Windows\System32
Subtle misspellings to hide rogue processes masquerading as [Link] in plain sight
Core Windows Processes 7
The user is not the SYSTEM user.
[Link]
The Windows Initialization Process, [Link], is responsible for launching [Link] (Service Control Manager),
[Link] (Local Security Authority), and [Link] within Session 0. It is another critical Windows process that runs in the
background, along with its child processes.
Note: [Link] is a process associated with Credential Guard and KeyGuard. You will only see this process if Credential
Guard is enabled.
What is normal?
Image Path: %SystemRoot%\System32\[Link]
Parent Process: Created by an instance of [Link]
Number of Instances: One
User Account: Local System
Start Time: Within seconds of boot time
What is unusual?
An actual parent process. ([Link] calls this process and self-terminates)
Image file path other than C:\Windows\System32
Subtle misspellings to hide rogue processes in plain sight
Multiple running instances
Not running as SYSTEM
[Link] > [Link]
Service Control Manager (SCM) or [Link].
Core Windows Processes 8
Its primary responsibility is to handle system services: loading services, interacting with services and starting or ending services.
It maintains a database that can be queried using a Windows built-in utility, [Link] .
C:\Users\Administrator> [Link]
DESCRIPTION:
SC is a command line program used for communicating with the
Service Control Manager and services.
USAGE:
sc <server> [command] [service name] <option1> <option2>...
Information regarding services is stored in the registry, HKLM\System\CurrentControlSet\Services .
This process also loads device drivers marked as auto-start into memory.
When a user logs into a machine successfully, this process is responsible for setting the value of the Last Known Good control
set (Last Known Good Configuration), HKLM\System\Select\LastKnownGood , to that of the CurrentControlSet.
Core Windows Processes 9
This process is the parent to several other key processes: [Link], [Link], [Link], and [Link], to name a
few. You can read more about this process here.
What is normal?
Core Windows Processes 10
Image Path: %SystemRoot%\System32\[Link]
Parent Process: [Link]
Number of Instances: One
User Account: Local System
Start Time: Within seconds of boot time
What is unusual?
A parent process other than [Link]
Image file path other than C:\Windows\System32
Subtle misspellings to hide rogue processes in plain sight
Multiple running instances
Not running as SYSTEM
[Link] > [Link] > [Link]
Responsibilities of [Link], [Link] and [Link]
Process Responsibilities
Initializes the Windows operating system and starts the Service Control
[Link]
Manager (SCM).
[Link] Manages system services and provides an interface for controlling them.
[Link] Hosts one or more Windows services and manages their execution.
The services running in this process are implemented as DLLs.
DLLs?
DLL stands for Dynamic Link Library. It is a type of file format used by Microsoft Windows operating systems to store shared
code and data that can be used by multiple applications at the same time.
The DLL to implement is stored in the registry for the service under the Parameters subkey in ServiceDLL . The full path
is HKLM\SYSTEM\CurrentControlSet\Services\SERVICE NAME\Parameters .
The example below is the ServiceDLL value for the Dcomlaunch service.
To view this information from within Process Hacker, right-click the [Link] process. In this case, it will be PID 748.
Core Windows Processes 11
Right-click the service and select Properties. Look at Service DLL.
From the above screenshot, the Binary Path is listed.
Also, notice how it is structured. There is a key identifier in the binary path, and that identifier is -k . This is how a legitimate
[Link] process is called.
The -k parameter is for grouping similar services to share the same process. This concept was based on the OS design and
implemented to reduce resource consumption. Starting from Windows 10 Version 1703, services grouped into host processes
changed. On machines running more than 3.5 GB of memory, each service will run its own process. You can read more about
this process here.
Core Windows Processes 12
Back to the key identifier (-k) from the binary path, in the above screen, the -k value is Dcomlaunch. Other services are running
with the same binary path in the virtual machine attached to this room.
Each will have a different value for ServiceDLL.
Let's take LSM as an example and inspect the value for ServiceDLL.
Since [Link] will always have multiple running processes on any Windows system, this process has been a target for
malicious use. Adversaries create malware to masquerade as this process and try to hide amongst the legitimate [Link]
processes. They can name the malware [Link] or misspell it slightly, such as [Link]. By doing so, the intention is to
go under the radar. Another tactic is to install/call a malicious service (DLL).
Extra reading - Hexacorn Blog
What is normal?
Core Windows Processes 13
Image Path: %SystemRoot%\System32\[Link]
Parent Process: [Link]
Number of Instances: Many
User Account: Varies (SYSTEM, Network Service, Local Service) depending on the [Link] instance. In Windows 10, some
instances run as the logged-in user.
Start Time: Typically within seconds of boot time. Other instances of [Link] can be started after boot.
What is unusual?
A parent process other than [Link]
Image file path other than C:\Windows\System32
Subtle misspellings to hide rogue processes in plain sight
The absence of the -k parameter
[Link]
"Local Security Authority Subsystem Service (LSASS) is a process in Microsoft Windows operating systems that is responsible
for enforcing the security policy on the system. It verifies users logging on to a Windows computer or server, handles password
changes, and creates access tokens. It also writes to the Windows Security Log."
How it works ( Additional Info )
[Link] (Local Security Authority Subsystem Service) is a process in the Windows operating system responsible for
managing security and authentication services. It is an essential part of the operating system and is required for many system
functions to work properly.
When a user logs in to a Windows system, [Link] creates security tokens that are used to verify the user's identity and
control their access to system resources. These tokens contain information about the user's account, such as their username,
group membership, and security privileges.
[Link] creates security tokens for different authentication sources, including SAM (Security Account Manager), which
manages local user accounts, and AD (Active Directory), which manages accounts for network resources. It also creates
security tokens for the NETLOGON service, which provides network authentication services.
To create these security tokens, [Link] uses authentication packages specified in the
HKLM\System\CurrentControlSet\Control\Lsa registry key. These packages are responsible for validating user credentials and
Core Windows Processes 14
creating security tokens that can be used to access system resources.
[Link] is another process adversaries target
Common tools such as mimikatz are used to dump credentials, or adversaries mimic this process to hide in plain sight.
Again, they do this by either naming their malware by this process name or simply misspelling the malware slightly.
Extra reading: How LSASS is maliciously used and additional features that Microsoft has put into place to prevent these
attacks.
What is normal?
Image Path: %SystemRoot%\System32\[Link]
Parent Process: [Link]
Number of Instances: One
User Account: Local System
Start Time: Within seconds of boot time
What is unusual?
A parent process other than [Link]
Image file path other than C:\Windows\System32
Subtle misspellings to hide rogue processes in plain sight
Multiple running instances
Not running as SYSTEM
[Link]
The Windows Logon, [Link], is responsible for handling the Secure Attention Sequence (SAS). It is the
ALT+CTRL+DELETE key combination users press to enter their username & password.
This process is also responsible for loading the user profile. It loads the user's [Link] into HKCU, and [Link]
loads the user's shell. Read more about this process here.
It is also responsible for locking the screen and running the user's screensaver, among other functions. You can read more
about this process here.
Core Windows Processes 15
What is normal?
Image Path: %SystemRoot%\System32\[Link]
Parent Process: Created by an instance of [Link] that exits, so analysis tools usually do not provide the parent process
name.
Number of Instances: One or more
User Account: Local System
Start Time: Within seconds of boot time for the first instance (for Session 1). Additional instances occur as new sessions are
created, typically through Remote Desktop or Fast User Switching logons.
What is unusual?
An actual parent process. ([Link] calls this process and self-terminates)
Image file path other than C:\Windows\System32
Subtle misspellings to hide rogue processes in plain sight
Not running as SYSTEM
Shell value in the registry other than [Link]
[Link]
Windows Explorer, [Link].
This process gives the user access to their folders and files. It also provides functionality for other
features, such as the Start Menu and Taskbar.
As mentioned previously, the Winlogon process runs [Link], which launches the value in HKLM\Software\Microsoft\Windows
NT\CurrentVersion\Winlogon\Shell . [Link] exits after spawning [Link]. Because of this, the parent process is non-
existent.
Core Windows Processes 16
There will be many child processes for [Link].
What is normal?
Image Path: %SystemRoot%\[Link]
Parent Process: Created by [Link] and exits
Number of Instances: One or more per interactively logged-in user
User Account: Logged-in user(s)
Start Time: First instance when the first interactive user logon session begins
What is unusual?
An actual parent process. ([Link] calls this process and exits)
Image file path other than C:\Windows
Running as an unknown user
Subtle misspellings to hide rogue processes in plain sight
Outbound TCP/IP connections
Core Windows Processes 17
Note: The above image is the [Link] properties view from Process Explorer.
Conclusion
What is unusual for all we mentioned
Number of
Process Responsibilities Parent Process Image Path User Account Start Time
Instances
Manages
system-wide
operations such
as hardware
virtualization,
System N/A N/A One Local System N/A
process and
memory
management,
and security
policies.
Creates and
initializes the
Session
Manager
Subsystem
(smss), starts the
Windows During syste
[Link] System \SystemRoot\System32\[Link] One Local System
subsystem startup
([Link] and
[Link]) in
Session 0, and
creates child
instances in new
sessions.
Manages
graphical
instructions such
as displaying
Windows logon During syste
[Link] [Link] \Windows\System32\[Link] One or more Local System
screen, and startup
creates and
deletes threads
for console
windows.
Performs the
final stages of
the Windows
initialization
process, such as During syste
[Link] [Link] \Windows\System32\[Link] One Local System
starting services startup
and drivers
marked as Boot
Start in the
registry.
Core Windows Processes 18
Number of
Process Responsibilities Parent Process Image Path User Account Start Time
Instances
Launches and
manages system
services, such as During syste
[Link] [Link] \Windows\System32\[Link] One Local System
the Windows startup
Event Log and
Plug and Play.
Hosts multiple
system services
that run as
dynamic-link
libraries (DLLs).
Each instance of
During syste
[Link] [Link] can [Link] \Windows\System32\[Link] Multiple Local System
operation
host several
services, making
it easier to
manage and
conserve system
resources.
Manages
security policies
and
authentication on
the system,
creates security
tokens for SAM
(Security
Account During syste
[Link] [Link] \Windows\System32\[Link] One Local System
Manager), AD operation
(Active
Directory), and
NETLOGON,
and uses
authentication
packages
specified in the
registry.
Manages the
Windows logon
process, loads
the user profile
on logon, and
performs
During syste
[Link] security-related [Link] \Windows\System32\[Link] One or more Local System
operation
tasks such as
locking the
desktop and
responding to
Ctrl+Alt+Delete
requests.
Core Windows Processes 19
Number of
Process Responsibilities Parent Process Image Path User Account Start Time
Instances
Provides the
Windows shell
for the desktop,
file management,
and taskbar, and
Local System or During user
[Link] launches user [Link] \Windows\[Link] One or more
User login
applications.
Also, manages
the Start menu,
desktop, and file
associations.
Core Windows Processes 20