CB ThreatHunter: Why Is the Process Tree For System Empty?
book
Article ID: 286058
calendar_today
Updated On:
Products
Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)
Issue/Introduction
Why Is the Process Tree For "System" Empty?
Environment
CB ThreatHunter: All Supported Versions
Resolution
The system ‘process’ is a special case. It’s not the same as a normal process and is dynamically created at boot-time (so it’s not an .exe or .dll). "System" is given a process id (PID) of 4, and only runs worker threads. There are no child processes of system and therefore there’s not going to be a process tree for it, even though it could have events associated to it.