Introduction
Windows is the most used Operating System in the world , especially when it comes to Enterprises . we use CTRL+ALT+DEL combination everyday, right ? We see lots of processes in Task Manager but how many of us know what these processes really do ? If you are a Blue Teamer in the Cyber Security field , you have to know the normal behavior of the core processes to detect unusual behaviors that may happen one day.
How to Detect Unusual Behaviors
Task Manager is a simple utility to check processes that your computer runs. You can open it by using CTRL+SHIFT+ESC combination. Click on “Details” tab.
Even though it seems a little bit complicated, it is not enough for us. We have to know parent and child process information, so we can use Process Hacker or Process Explorer tools instead of Task Manager.
So , as a Blue Teamer how do we detect an unusual behavior at someone's computer in our company ? This is the place where EDR ( Endpoint Detection and Response) solutions come into play. But we will not go into EDR subject in this article.
Core Processes
System Process
Our first process is System. normally the PID's (Process ID) are generated randomly. but the Process ID of System Process is always 4.
path: C:\Windows\system32\ntoskrnl.exe
parent: System Idle Process (0)
Number of Processes: What's that
Start Time: Boot
System Process > SMSS.EXE
Session Manager Subsystem is responsible for creating new sessions and environment variables , starting the kernel-mode and user-mode of the Windows subsystem.
Smss.exe starts csrss.exe and wininit.exe in an isolated Windows Session (Session 0) ,csrss.exe and winlogon.exe in user session (session 1).
path: %SystemRoot%\System32\smss.exe
parent : System
Number of Processes: One master and one child instance per session.
CSRSS.EXE
Client Server Runtime Process is user-mode side of the Windows subsystem. This process is always working and if something happens to csrss.exe all the system will crash. This process is responsible for Windows API available for other processes , Win32 Console Window , Process thread creation and deletion.
path: %SystemRoot%\System32\csrss.exe
parent: Created by an instance of smss.exe
Number of Processes: many
WININIT.EXE
the Windows Initialization Process, wininit.exe, is responsible for launching services.exe (Service Control Manager), lsass.exe (Local Security Authority), and lsaiso.exe within Session 0.
path: %SystemRoot%\System32\wininit.exe
parent: Created by an instance of smss.exe
Number of Processes: What's that
WININIT.EXE > SERVICES.EXE
Service Control Manager (services.exe) handles system services; loading , interacting , starting/ending services etc. You can find information about these services in the registry , HKLM\SYSTEM\CurrentControlSet\Services.
path: %SystemRoot%\System32\services.exe
parent: wininit.exe
Number of Processes: What's that
WININIT.EXE > SERVICES.EXE > SVCHOST.EXE
The Service Host (svchost.exe) responsible for hosting and managing windows services. The services running in this process are DLLs. You can see these DLLs in the registry editor, HKLM\SYSTEM\CurrentControlSet\SERVICENAME\Parameters.
If you use Process Monitor you can see lots of svchost.exe. So it can be easy for a hacker to hide in it.
path: %SystemRoot%\System32\svchost.exe
parent: services.exe
Number of Processes: many
LSASS.EXE
Local Security Authority Subsystem Service (lsass.exe) is a process for enforcing the security policy on the system. It verifies users when doing some tasks , like Cookies in browsers . Lsass.exe doing this job by creating security token for SAM , AD and NETLOGON.
This is another process adversaries target. Especially Mimikatz tool is trying to dump credentials from lsass.exe.
path: %SystemRoot%\System32\lsass.exe
parent: wininit.exe
Number of Processes: What's that
WINLOGON.EXE
The Windows Logon (winlogon.exe) is , as you can understand from its name, responsible for handling everything related to the user's logon.
path: %SystemRoot%\System32\winlogon.exe
Process: Created by an instance of smss.exe.
Number of Processes: One or more
EXPLORER.EXE
Windows Explorer (explorer.exe) gives the user access to their folders and files. I believe it is the most well-known process. It also provides functionality to other features such as Start Menu , Taskbar etc.
Path: %SystemRoot%\explorer.exe
Parent: Created by userinit.exe then exits
Number of Processes: one or more
Sources:
https://tryhackme.com/room/btwindowsinternals
https://nasbench.medium.com/windows-system-processes-an-overview-for-blue-teams-42fa7a617920