Example: Tag a Process and Report its Children

You can tag all processes that are launched by svchost.exe so that you can report when the child processes are running.

You can create a pair of rules for this purpose. Name the rules in a way that makes their relationship clear, and consider providing more information in the Description field for each one.

Create one Custom rule that applies a tag to a process if it is launched by svchost.exe.

For example:

• Operations: Process Create
• Actions: Tag Target
• Tags to Add/Remove: childofsvchost
• Process: svchost.exe

Create a second Custom rule that reports creation of processes identified with the tag created in the previous rule

For example:

• Operations: Process Create
• Actions: Report
• Process Tag(s): childofsvchost