Windows 10 Core Processes
1) SYSTEM - This is the first process in the windows process lineage. This process host most of the kernel-mode threads. The modules that run under the System process are drivers ie ".sys" files and some important executables such as ntoskrnl.exe.
Normal attributes of this process:
Image Path: There is no image path or executable file associated with this process on the disk.
User account: User account will be NT AUTHORITY/ SYSTEM
Parent Process: There is No parent process associated with the system process.
Process ID: Process ID will always be 4.
Number of Instances: There will always be one instance of the System process.
Argument: No command-line argument.
Other: There will always be one thread per CPU core.
Abnormal to look for:
System process having Parent process
The process ID is other than 4
More than one instance of System process running.
2) SMSS.exe - Session manager subsystem. This is the first user-mode process.
The Session Manager process is responsible for creating new Sessions, Environment variables, Starts the kernel and user modes of the Win32 subsystem aka windows API.
The important thing to note during process lineage analysis is that the Smss.exe created by the System process is known as Master SMSS.exe. This master smss.exe creates at least 2 subordinate instances of smss.exe for each session created. These child instances further initiate "winit.exe" in session 0 and process "winlogon.exe" in session 1 respectively. Once these processes are initiated the subordinate instances of Smss.exe will exit.
What is Normal:
- Image Path: \%systemroot%\System32\smss.exe
- User account: This process will run with the NT AUTHORITY/ SYSTEM
- Parent Process: will always be System
- Number of Instances: Multiple during boot-up and only one without arguments after boot-up.
- Argument: No command-line argument.
- Other:
Abnormal to look for:
More than 1 instance of smss.exe is active.
Parent process other than System or PPID other than 4
Having command-line argument.
Initiating from the directory other than System32
3) CSRSS.exe - client-server subsystem - Prior to the release of Windows NT 4.0 in 1996, it was the csrss.exe responsibility to support the entire graphical user interface subsystem that included controlling Windows, drawing on the screen, and similar other OS based functions. However, with the Windows NT 4.0 launch, most of these functions went obsolete from the csrss.exe. But, the Client Server Runtime Process still supports the Windows console and the process of shutdown.
What is Normal:
- Image Path: \%systemroot%\System32\csrss.exe
- User account: The user account will be NT AUTHORITY/ SYSTEM
- Parent Process: Will not be visible in the general case as smss.exe child instance will exit once csrss.exe is initiated
- Number of Instances: At least 2 instances will be running. One instance in session 0 and another one in session 1.
Abnormal to look for:
Displaying Parent process name that is other than smss.exe
Initiating from the directory other than System32
4) WININIT.EXE — Windows Initialize.exe. Wininit.exe starts key background processes within Session 0. It is a core system process that originates in Windows XP. It reads and processes the commands stored in the file WinInit.ini file. Which ultimately allows programs to take action while the computer is still in booting mode. It primarily acts as a launcher for the majority of the background applications that are always running.
What is Normal:
- Image Path: \%systemroot%\System32\wininit.exe
- User account: The user account will be NT AUTHORITY/ SYSTEM
- Parent Process: Will not be visible in general case as smss.exe child instance will exit once wininit.exe is initiated
- Number of Instances: only 1 instance running in session 0.
- Argument: No command-line argument.
Abnormal to look for:
Running outside system32
Running as non SYSTEM user
Displaying Parent process name that is other than smss.exe
Having command-line argument.
5) SERVICES.EXE — Service Control Manager. As the name suggests this process is responsible to starts, stops and interacting with Windows service processes.
Implements the Unified Background Process Manager (UBPM), which is responsible for background activities such as services and scheduled tasks. Services.exe also launches the autostart services and drivers by reading the registry key
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services. Once the user successfully logs in then service.exe loads the Last Known Good control set (HKLM\SYSTEM\Select\LastKnownGood) to the value of the CurrentControlSet.
What is Normal:
Runs within session 0
- Image Path: %SystemRoot%\System32\services.exe
- User account: The user account will be NT AUTHORITY/ SYSTEM
- Parent Process: will be Winit.exe
- Number of Instances: only 1 instance running in session 0.
6) LSASS.EXE — The Local Security Authentication Subsystem Service is a user-mode process that is responsible for authenticating users by calling an appropriate authentication package specified in HKLM\SYSTEM\CurrentControlSet\Control\Lsa registry key. Typically, this will be Kerberos for domain accounts or MSV1_0 for local accounts. In addition to authenticating users, lsass.exe is also responsible for implementing the local security policy (such as password policies and audit policies) and for writing events to the security event log.
Image Path: %SystemRoot%\System32\Lsass.exe
User account: User account will be NT AUTHORITY/ SYSTEM
Parent Process: Wininit.exe
Number of Instances: There will always be one instance of the lsass.exe process. And should have no child processes except EFS (Encrypting File System).
Other: Often targeted by malware as a means to dump passwords. Also mimicked by malware to hide on a system (lass.exe, lssass.exe, lsasss.exe, etc.). These “fake” names will not be a child of wininit.exe.
7) LSAiso.exe - LSA isolate.exe. As the name describes this is an isolated LSA process that runs in a virtualized environment by leveraging the Hardware virtualization technology. Lsaio.exe appears in the process tree when the credential guard is enabled in Windows 10. This provides added security against credential dumping attacks.
Image Path: %SystemRoot%\System32\Lsaiso.exe
User account: User account will be NT AUTHORITY/ SYSTEM
Parent Process: Wininit.exe
Number of Instances: There will always be one instance of lsaiso.exe process. And should have no child processes.
Other: this process should only appear in the process tree if the credential guard is enabled.
8) SVCHOST.EXE — Service Hosting Process - This process host multiple DLL files of multiple services for implementing the shared service model which ultimately helps in preserving the CPU resources. But this is no more valid from Windows 10 (version 1703) Now in Windows 10 services will be hosted in their individual svchost.exe process if the machine has a memory of more than 3.5 GB.
Image Path: %SystemRoot%\System32\svchost.exe
User account: User account will be NT AUTHORITY\SYSTEM, LOCAL SERVICE, or NETWORK SERVICE. Now in windows 10, some instances run with user account as well.
Parent Process: services.exe
Number of Instances: Multiple instances can run
The command-line argument must contain "-k" parameter.
Other: the process should be running in session 0 This will be valid only in case of windows prior to win10. This process is often been the target of malware developers due to its ubiquitous nature. This allows hiding malware in plain sight. A simple similar spelling will fool an untrained eye.. For example "scvhost.exe"
9) RUNTIMEBROKER.exe - This process was introduced in Windows 8 and is available in windows 10 as well. The task of this process is to check for the windows apps required permissions such as location access, microphone access, etc.
Image Path:%SystemRoot%\System32\runtimebroker.exe
User account: logged on a user account
Parent Process: svchost.exe
Number of Instances: One instance per Universal Windows Platform (aka windows store apps) opened
10) TASKHOSTW.exe - Taskhostw process hosts DLL files related to scheduled tasks. This continuously listens for the triggers to initiate the tasks. Microsoft has renamed the Host Process multiple times. In Windows 7 it was named taskhost.exe, in Windows 8 it was called taskhostex.exe and the new name is taskhostw.exe in Windows 10. So just by looking at the name of the Taskhost process, we can recognize the OS version.
Image Path: %SystemRoot%\System32\taskhostw.exe
User account: The user account will be the system account or logged-on user account.
Parent Process: svchost.exe
Number of Instances: Multiple instances can run
11) LSM.EXE — Load Session Manager Service
Manages the state of terminal server sessions on the local machine. Sends the requests to smss.exe to start new sessions.
There must only be 1 instance of lsm.exe on Windows 7 machines. You should NOT be seeing this on Windows 8 and windows 10. It will be running as a service DLL instead — lsm.dll.
Child to wininit.exe
It should not have child processes
Receives logon/off, shell start and termination, connect/disconnects from a session, and lock/unlock desktop
%systemroot%\System32\lsm.exe
Base Priority of 8
Username: NT AUTHORITY\SYSTEM
Runs within session 0
12) WINLOGON.exe - Winlogon handles interactive user logons and logoffs. It launches
LogonUI.exe, which loads DLLs called the credential provider to collect the credentials from the user. Once it has the credentials it passes them to lsass.exe for validation. When the user is authenticated then Winlogon loads the user’s NTUSER.DAT file into the Current User registry hive and starts the user’s shell (usually explorer.exe) via userinit.exe.
Image Path: %SystemRoot%\System32\winlogon.exe
User account: User account will be NT AUTHORITY/ SYSTEM
Parent Process: will be the exited subordinate smss.exe
Number of Instances: One or more depending upon the logged-on users.
Other: Will always be in sessions other than zero.
LogonUI.exe - It loads the credential provider to collect the credentials from the user. Once it has the credentials it passes them to lsass.exe for validation.
USERINIT.exe - Runs the initial scripts and initiate the Explorer.exe
13) Explorer.exe - This provides a default user shell or interfaces to end-users to interact with windows.
mage Path: %SystemRoot%\explorer.exe
User account: User account will be NT AUTHORITY/ SYSTEM
Parent Process: winit.exe
Number of Instances: One or more depending upon the logged on users
++++++++++++++++++++++++++++++++++++++++++++++++++++
reference:
Session 0: http://securityinternals.blogspot.com/2014/02/windows-session-0-isolation.html
Sessions, Windows and Desktops: http://securityinternals.blogspot.com/2014/01/on-sesssion-windows-and-desktops.html>
System Idle Process: http://securityinternals.blogspot.com/2013/12/what-are-system-idle-processes.html
Windows Registry: http://securityinternals.blogspot.com/2014/04/windows-registry.html
Credential Guard: https://docs.microsoft.com/en-us/archive/blogs/ash/windows-10-device-guard-and-credential-guard-demystified
Service vs Application: http://securityinternals.blogspot.com/2014/01/difference-between-windows-service-and.html
