# Process Trees & Command Line Analysis

> Master the most critical endpoint telemetry. Learn to analyze parent-child process lineage, decode obfuscated command lines, and build high-fidelity detections against Living-off-the-Land attacks.

Canonical: https://codelivly.com/rooms/process-trees-command-line-analysis
Last updated: 2026-07-06

| | |
|---|---|
| Level | Advanced |
| Category | Cybersecurity |
| Lessons | 5 |
| Estimated time | 30 min |
| XP | 200 |

Dive into the granular world of process execution and command-line telemetry. The Process Trees & Command Line Analysis module breaks down how to read, analyze, and weaponize the data generated when programs spawn other programs.

You will learn how to map complex parent-child process relationships, decode obfuscated PowerShell and CMD arguments, identify anomalous process lineage (like winword.exe spawning cmd.exe), and write SIEM queries that catch sophisticated Living-off-the-Land (LotL) techniques. By the end of this module, you will be able to look at a raw process tree and instantly reconstruct an attacker's kill chain.

## Lessons

1. Reading a Process Tree (30 min)
2. Spotting Suspicious Command Lines (30 min)
3. Living-off-the-Land Binaries (30 min)
4. Persistence Mechanisms (30 min)
5. Autoruns & Startup Analysis (30 min)

## Related

- [Learning path: Endpoint & Network Security Monitoring](https://codelivly.com/learning-paths/endpoint-network-security-monitoring)
- [All rooms](https://codelivly.com/rooms)