Overview#

You can indirectly track child processes created by a process by monitoring registry set events for the following key HKLM\System\CurrentControlSet\Services\bam\State\UserSettings\<SID>\<Binary>

Examples#

  • Cmd.EXE Creating Rundll32.EXE
image
  • Explorer.EXE Creating Microsoft Paint
image

References#

Related Articles

Other threads in the archive worth reading next.