Parent Processes

Finding an unwanted program is only the beginning. You also want to know how it started. A parent process is the program that launched another program.

Look at the parent in this practice record:

seclab inspect processes demo-helper

Look for these lines:

demo-helper:
  Parent process: demo-browser

Here, demo-browser started demo-helper. Read the browser record before drawing a conclusion:

seclab inspect processes demo-browser

You should see:

demo-browser:
  Machine: practice-laptop
  User: maya
  File: demo-browser
  Parent process: -
  Running: yes
  Command: /opt/lumen/demo-browser

An approved browser can launch an unsafe download. That does not mean the browser itself needs to be removed. The link gives you a place to investigate next: what the person opened or downloaded.

Use the parent’s process name when you record your finding:

seclab answer parent demo-browser

You should see:

Recorded your answer to parent.