Knowledge is Power
BARE METAL CYBERKnowledge is Power

Sitewide Search

Search Bare Metal Cyber

Search courses, individual lessons, wiki entries, books, podcasts, magazine articles, Daily Cyber News, and Darwin.

MITRE D3FEND™ Learning Center

D3-PLA — Process Lineage Analysis

Identification of suspicious processes executing on an end-point device by examining the ancestry and siblings of a process, and the associated metadata of each node on the tree, such as process execution, duration, and order relative to siblings and ancestors.

14Enterprise inferred
7ICS inferred
1Parent technique
2Related artifacts

Detect · D3FEND ontology 1.6.0 · Active

Open official technique ↗
Official D3FEND definition

Definition

Identification of suspicious processes executing on an end-point device by examining the ancestry and siblings of a process, and the associated metadata of each node on the tree, such as process execution, duration, and order relative to siblings and ancestors.

Official D3FEND knowledge-base content

How it works

Process tree analysis techniques gather information on how a process was initiated to determine if a process is malicious. For example, if a process was not initiated from boot or not initiated by another process, that process is identified as suspicious. Also, if a new process was started before a process initiated by the device (ex. during boot) and that new process was not initiated by a user (which can be determined by examining process parameters such as type of process, its creator, source, etc.) the process is identified as suspicious.

For example, Microsoft Word may block execution of any subprocess that is not in an approved path.

Considerations

  • Attackers may spoof the parent PID (https://attack.mitre.org/techniques/T1502/), rendering such after-the-fact analysis on process lineage ineffective.
  • Processes may hide from various means of detection; an example on Linux is where a rootkit might remove key files for the process from its directory in /proc.
  • Zombie processes.
Bare Metal Cyber interpretation

Implementation perspective

Process Lineage Analysis should be treated as a technical defensive capability rather than a product checkbox. In practice, teams should define the protected scope, the conditions under which the technique acts, and the observable evidence that demonstrates the intended behavior. For this technique, likely engineering context includes Process.

Use the technique to identify suspicious, unauthorized, or abnormal activity through observable evidence and repeatable analysis.

Questions to ask

  • Which events, states, or artifacts must be observed for the analysis to work?
  • What analytic logic, threshold, comparison, or signature turns observations into a finding?
  • How are expected false positives, blind spots, and environmental variations documented?
  • Who receives the result, and what action is expected when the technique produces a finding?

Evidence and validation

  • Telemetry and data-source configuration records
  • Analytic logic, thresholds, signatures, and version history
  • Test cases demonstrating expected positive and negative results
  • Alert, triage, escalation, and tuning records

Common failure patterns

  • Required telemetry is missing, delayed, or transformed in a way that invalidates the analysis.
  • The technique produces alerts without an accountable triage and response process.
  • Detection coverage is claimed from product deployment without testing the relevant analytic behavior.

This implementation perspective is original Bare Metal Cyber educational content. It does not replace the official D3FEND definition or establish that a specific product implements the technique.

Ontology hierarchy

Technique hierarchy

Top-level family

Direct child techniques

None listed at this level.

D3FEND graph relationships

Artifacts and ontology entities

These relationships describe how D3FEND connects a defensive technique to artifacts or other ontology entities. They describe graph semantics, not a product certification.

Explicit technique relationships

analyzesProcess
analyzesProcess Tree
Show inferred artifact relationship paths (1)
Process Lineage AnalysisanalyzesProcess
Inferred and experimental

Offensive-technique relationships

These relationships are generated from D3FEND graph paths and are explicitly experimental. They should be treated as hypotheses for defensive analysis—not as proof that the technique prevents, detects, or removes an offensive behavior.

ATT&CK Enterprise (14)
T1003.001LSASS MemoryCredential AccessT1003.002Security Account ManagerCredential AccessT1003.004LSA SecretsCredential AccessT1033System Owner/User DiscoveryDiscoveryT1053Scheduled Task/JobExecution, Persistence, Privilege EscalationT1053.005Scheduled TaskExecution, Persistence, Privilege EscalationT1212Exploitation for Credential AccessCredential AccessT1505.002Transport AgentPersistenceT1505.003Web ShellPersistenceT1546.007Netsh Helper DLLPersistence, Privilege EscalationT1550Use Alternate Authentication MaterialLateral MovementT1556Modify Authentication ProcessCredential Access, Defense Impairment, PersistenceT1562.001Disable or Modify ToolsStealthT1621Multi-Factor Authentication Request GenerationCredential Access
ATT&CK for ICS (7)
T0806Brute Force I/OImpair Process Control
T0813Denial of ControlImpact
T0814Denial of ServiceInhibit Response Function
T0819Exploit Public-Facing ApplicationInitial Access
T0821Modify controller TaskingExecution
T0823Graphical User InterfaceExecution
T0878Alarm SuppressionInhibit Response Function
Source record

Authoritative sources

Bare Metal Cyber is an independent educational publisher and is not affiliated with or endorsed by The MITRE Corporation. MITRE D3FEND™ and the D3FEND logo are trademarks of The MITRE Corporation. MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. Use of D3FEND source material is subject to the official Terms of Use.