Start here
The five checks
For any suspicious process, run it against five questions. A legit process passes all five; malware usually trips at least one.
1 · Correct image path?Almost all of these live in C:\Windows\System32. The same name running from %TEMP%, a user profile, or \Windows (not System32) is the classic tell.2 · Expected parent?Each core process has one normal parent. svchost from anything but services.exe, or lsass with a parent that isn't wininit, is wrong.3 · Right user context?Session-0 system processes run as SYSTEM / LOCAL SERVICE / NETWORK SERVICE. A core service running as a normal user — or explorer running as SYSTEM — is inverted.4 · Expected instance count?Some run exactly once (lsass, services, wininit). Two lsass processes is one too many.5 · Signed by Microsoft?These are all Microsoft-signed. Unsigned, or a broken signature, on a "system" process is a red flag.Session 0 · boot
Boot & session
SystemPID 4 · no image on disk (kernel threads) · parent none · one instance · SYSTEM. Evil: a "System" with a real image path or a PID other than 4.Registry\System32 (memory-backed) · parent System · one · SYSTEM. Win10+ hive-management process.smss.exeSession Manager · \System32 · parent System · one master persists (children self-exit) · SYSTEM. Evil: multiple persistent copies, or not from System32.csrss.exe\System32 · parent created by smss (so parent usually shows blank) · one per session (≥2 normal) · SYSTEM. Evil: a visible parent, or a misspelling like csrsss.wininit.exe\System32 · parent smss (blank) · one · SYSTEM · Session 0. Starts services.exe / lsass.exe. Evil: more than one.winlogon.exe\System32 · parent smss (blank) · one per interactive session · SYSTEM. Handles the secure logon (Ctrl-Alt-Del). Evil: spawning cmd/powershell children.Session 0 · services
Core services
services.exeService Control Manager · \System32 · parent wininit · one · SYSTEM. Parent of most service processes. Evil: more than one, or a parent other than wininit.lsass.exeLocal Security Authority · \System32 · parent wininit · exactly one · SYSTEM · no child processes. Holds credentials — the #1 dump target. Evil: two copies, any children, a misspelling (lsas.exe, lsass1.exe), or anything reading its memory (Sysmon 10).svchost.exeService host · \System32 · parent services.exe · many · SYSTEM / LOCAL SERVICE / NETWORK SERVICE · always launched with -k <group>. Evil: no -k, wrong parent, wrong path, or a masquerade (scvhost, svch0st).lsaiso.exe\System32 · parent wininit · SYSTEM. Only present when Credential Guard is on — isolates LSA secrets.dwm.exeDesktop Window Manager · \System32 · parent wininit (Win10) · runs as a DWM-* window-manager account · one per session.spoolsv.exePrint Spooler · \System32 · parent services.exe · one · SYSTEM. A frequent exploit target (PrintNightmare) — watch for odd children.taskhostw.exeTask host for DLL-based tasks · \System32 · parent svchost · runs as the user · one or more.RuntimeBroker.exe\System32 · parent svchost · runs as the user · brokers app permissions. Multiple is normal.User session
User & shell
userinit.exe\System32 · parent winlogon · runs briefly then exits after launching the shell (so it's rarely seen live). It's why explorer's parent usually shows blank.explorer.exeThe shell · \Windows\explorer.exe (not System32) · parent userinit (exited, so blank) · one per logged-on user · runs as the user. Evil: running as SYSTEM, from the wrong path, or spawning cmd/powershell/mshta that then reaches the network.conhost.exeConsole host · \System32 · parent is the console app that opened it (or csrss) · runs as that user. Normal alongside any console program.ctfmon.exe\System32 · parent svchost · runs as the user · input/language services.SearchIndexer.exe\System32 · parent services.exe · SYSTEM · content indexing. One instance.Defender's view
Masquerade red flags
How a fake blends in — and gives itself away.
Right name, wrong pathsvchost.exe or lsass.exe running from %TEMP%, AppData, or C:\Windows\ instead of System32. The single most common trick.Look-alike spellingscvhost, svch0st, lsass1, csrsss, winlogin — one character off from the real name.Homoglyph / paddingA Cyrillic character in the name, or trailing spaces (svchost .exe) to hide the real extension.Wrong parentsvchost not from services.exe; lsass not from wininit; a system process spawned by explorer or winword.Wrong user contextexplorer.exe as SYSTEM, or a System32 service running under a normal user account.Unexpected countTwo lsass, several wininit, or more than one services.exe.Odd childrenlsass with any child, or winlogon / services spawning cmd or powershell.Unsigned or non-MicrosoftA "system" process with no signature, a broken one, or a signer that isn't Microsoft.Related: confirm parent/child trees with the PowerShell and Windows Event IDs sheets (4688 process creation, Sysmon 1/10), and the printable version is SANS's Find Evil — Know Normal poster in the tools on the home page.