Core Windows Processes - THM - SOC Level 1

Follow my page for simple and easy to understand content, I will write only that information that you have to know about that topic.

I simplifies content, I don’t just copy and paste text from THM room but I am adding topics from internet and write blog in that way so even any beginner can easily understood topic and get my point just by reading this blog. And I will try to keep this blog simple and easy because I also get bored reading unnecessary details. This room will be little bit longer because here I covered around 9 important process of Windows Operating System…….

I bought a subscription of TryHackMe, and here I will write blogs to share knowledge, and I am writing blogs for all rooms of SOC Level 1, so stay tuned and follow the page.

INDEX

1. Task Manager
2. System
3. smss.exe
4. csrss.exe
5. wininit.exe - IMP
6. services.exe -IMP
7. svchost.exe - IMP
8. lsass.exe - IMP
9. winlogon.exe - IMP
10. explorer.exe - IMP

I am also attaching screenshot of normal behavior and unusual behavior of process that helps you for investigation…

In this room, we will explore the core processes within a Windows system. This room aims to help you know and understand what normal behaviour within a Windows operating system is. This foundational knowledge will help you identify malicious processes running on an endpoint.

TASK MANAGER

Task Manager is a built-in GUI-based Windows utility that allows users to see what is running on the Windows system. It also provides information on resource usage, such as how much each process utilizes CPU and memory.

You can open task manager by Ctrl+Shift+Esc or by right click on Task Menu. You can terminate or Relaunch any App or service from Task manager just by right clicking that process.

(Here I am showcase some field that you have to know, I am not making mess by pasting all stuff [I will write only info that you have to know])

The view looks a little better. Let’s briefly go over each column (excluding Name, of course):

• Type — Each process falls into 1 of 3 categories (Apps, Background process, or Windows process).
• PID — This is known as the process identifier number. Windows assigns a unique process identifier each time a program starts.
• Command line — The full command used to launch the process.

SYSTEM

The first Windows process on the list is System. It was mentioned in a previous section that a PID for any given process is assigned at random, but that is not the case for the System process. The PID for System is always 4.

The System process (PID 4) runs special threads called kernel-mode system threads, which only operate in kernel mode. These threads are similar to regular user-mode threads (having priorities, hardware context, etc.), but they only execute system-level code from Ntoskrnl.exe or device drivers.

Unlike user-mode threads, system threads don’t have their own process address space.

Parent Process: System Idle Process (0)

PID: 4

Upper info is usual behavior, if there is something different in Parent process or PID than unusual, it is malicious.

Q: What PID should System always be?

ANSWER: 4

SMSS.EXE (system > smss.exe)

smss.exe (Session Manager Subsystem). This process, also known as the Windows Session Manager, is responsible for creating new sessions. It is the first user-mode process started by the kernel. Responsible for starting user sessions during system boot.

smss.exe starts csrss.exe and wininit.exe in Session 0 (used by the operating system) and csrss.exe and winlogon.exe in Session 1(the user session).

When a new session is created, smss.exe copies itself into the new session and then terminates itself after starting the necessary processes.

Normal and unusual behavior of smss.exe

Q: Aside from csrss.exe, what process does smss.exe spawn in Session 1?

ANSWER: winlogon.exe

CSRSS.EXE

As mentioned in the previous section, csrss.exe (Client Server Runtime Process) is the user-mode side of the Windows subsystem. This process is always running and is critical to system operation. If this process is terminated by chance, it will result in system failure. This process is responsible for the Win32 console window and process thread creation and deletion.

This process is also responsible for making the Windows API available to other processes, mapping drive letters, and handling the Windows shutdown process.

Normal and unusual behavior of csrss.exe

Q: What was the process which had PID 384 and PID 488?

ANSWER: smss.exe

WININIT.EXE

The Windows Initialization Process, wininit.exe, is responsible for launching services.exe (Service Control Manager), lsass.exe (Local Security Authority), and lsaiso.exe within Session 0. It is another critical Windows process that runs in the background, along with its child processes.

• It ensures that key services are running before the user logon process begins.
• It operates in Session 0, handling system-level services before user sessions are created.

Normal and unusual behavior of wininit.exe

Q: Which process might you not see running if Credential Guard is not enabled?

ANSWER: lsaiso.exe

SERVICES.EXE (wininit.exe > services.exe)

Its primary responsibility is to handle system services: loading services, interacting with services and starting or ending services. It maintains a database that can be queried using a Windows built-in utility.

It is a core Windows process that manages services on the system. It is responsible for starting, stopping, and interacting with system services such as networking, security, and hardware services. It runs in Session 0 (the system session) and is essential for system functionality. This process also loads device drivers marked as auto-start into memory.

Normal and unusual behavior of services.exe

Q: How many instances of services.exe should be running on a Windows system?

ANSWER: 1

SVCHOST.EXE (services.exe > svchost.exe)

is a system process that acts as a host for various Windows services running in the background. Each instance of svchost.exe may host one or more services, allowing the system to manage multiple services efficiently. Multiple instances of svchost.exe run simultaneously, each for different groups of services.

basically it is responsible for hosting and managing Windows services.

Since svchost.exe will always have multiple running processes on any Windows system, this process has been a target for malicious use. Adversaries create malware to masquerade as this process and try to hide amongst the legitimate svchost.exe processes. They can name the malware svchost.exe or misspell it slightly, such as scvhost.exe. By doing so, the intention is to go under the radar. Another tactic is to install/call a malicious service.

Normal and unusual behavior of svchost.exe

Q: What single letter parameter should always be visible in the Command line or Binary path?

ANSWER: k

LSASS.EXE

is a critical Windows process responsible for enforcing security policies, managing user authentication, and password validation. It handles login requests and Active Directory authentication. If lsass.exe is compromised, it could lead to unauthorized access or security breaches.

Lsass.exe is another process adversaries target. Common tools such as mimikatz are used to dump credentials, or adversaries mimic this process to hide in plain sight. Again, they do this by either naming their malware by this process name or simply misspelling the malware slightly.

Q: What is the parent process for LSASS?

ANSWER: wininit.exe

WINLOGON.EXE

winlogon.exe is a critical system process in Windows responsible for handling user logins, logouts, and security operations. It runs in the background as a protected system process and should always be located in C:\Windows\System32\winlogon.exe.

It is also responsible for locking the screen and running the user’s screensaver, among other functions. Remember from earlier sections, smss.exe launches this process along with a copy of csrss.exe within Session 1.

Q: What is the non-existent parent process for winlogon.exe?

ANSWER: smss.exe

EXPLORER.EXE

explorer.exe is a crucial system process in Windows that serves as the Windows Explorer or File Explorer. It is responsible for managing the graphical user interface (GUI) elements like:

• Taskbar (Start menu, system tray, and quick launch)
• Desktop (Icons, wallpapers, and right-click context menu)
• File Explorer (Browsing files, folders, and drives)

As mentioned previously, the Winlogon process runs userinit.exe, and then Userinit.exe exits after spawning explorer.exe. Because of this, the parent process is non-existent. Always ensure it’s running from C:\Windows to avoid malware impersonation.

Q: What is the non-existent process for explorer.exe?

ANSWER: userinit.exe

Thank you for Reading till this, follow my page for more blogs.

LINKS: LINK OF MORE BLOGS WILL APPEAR HERE SOON