← tools

Process Tree Viewer

Click any node to see parent–child analysis and ATT&CK mapping.

Example tree

normal suspicious system — click any node for details

Select a node to view analysis.

Command line

Node colors indicate assessment relative to expected process ancestry. Green = expected parent–child relationship. Red = anomalous or suspicious relationship — investigate. Blue = kernel/system process with no user-mode parent.