FalconFriday — Parent-child relationships & impersonation with RunAs

In today’s edition, we’ll cover two techniques: suspicious parent-child process relationships and impersonation with the RunAs command.

Today’s content

Suspicious parent-child process relationships
Impersonation using ‘RunAs’

Cross post from medium.com, please read the full article here:

https://medium.com/falconforce/falconfriday-e4554e9e6665

Direct link to our Github page:

https://github.com/FalconForceTeam/FalconFriday