Two copies of lsass
windows.pstree shows two processes named lsass.exe. Use parent, path, and command line to tell the real Local Security Authority from the impostor.
Briefing
A server’s EDR agent stopped reporting an hour ago. The image is cases/app-07/app-07.mem. On a healthy Windows host there is exactly one lsass.exe, a child of wininit.exe, running from System32.
windows.pstree prints the process tree with asterisks for depth, plus each process’s command line and image path.
forensics-ws · Memory forensics
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.