CB ThreatHunter: Why Is the Process Tree For System Empty?
search cancel

CB ThreatHunter: Why Is the Process Tree For System Empty?

book

Article ID: 286058

calendar_today

Updated On:

Products

Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

Why Is the Process Tree For "System" Empty?

Environment

  • CB ThreatHunter: All Supported Versions

Resolution

The system ‘process’ is a special case. It’s not  the same as a normal process and is dynamically created at boot-time (so it’s not an .exe or .dll). "System" is given a process id (PID) of 4, and only runs worker threads. There are no child processes of system and therefore there’s not going to be a process tree for it, even though it could have events associated to it.