Process Creation

What actually happens when Windows creates a process — the ten stages from CreateProcess to first instruction, kernel callbacks that EDRs hook, and the malware techniques that abuse the creation sequence

The Process Creation Pipeline

Process creation flows through multiple layers before the first user instruction executes. The journey from a CreateProcess call to a running process involves the Win32 subsystem, the kernel executive, the memory manager, the loader, and security checks at each stage.

  Process Creation Flow (high level)
  ─────────────────────────────────────────────────────────────────────
  CreateProcessW()
       │ Win32 subsystem call
       ▼
  kernel32!CreateProcessInternalW()
       │ NT API call
       ▼
  NtCreateUserProcess()   ←── or NtCreateProcessEx for legacy
       │ Kernel-mode transition
       ▼
  ┌─────────────────────────────────────────────────────────────────┐
  │  PspCreateProcess() (kernel)                                   │
  │  1. Open executable image file                                 │
  │  2. Create process object (EPROCESS allocation)                │
  │  3. Create process address space (page directory)              │
  │  4. Map executable image + ntdll.dll                           │
  │  5. Create PEB (in process address space)                      │
  │  6. Inherit handle table from parent                           │
  │  7. Create initial thread (ETHREAD)                            │
  │  8. Fire PsSetCreateProcessNotifyRoutine callbacks  ← EDR hook │
  │  9. Return to user mode                                        │
  └─────────────────────────────────────────────────────────────────┘
       │
       ▼
  Process object returned, initial thread running ntdll!LdrInitializeThunk
       │ Loader runs:
       ▼
  1. Load required DLLs (import table resolution)
  2. Run DllMain for each loaded DLL (DLL_PROCESS_ATTACH)
  3. Run TLS callbacks
  4. Transfer control to AddressOfEntryPoint
       │
       ▼
  main() / WinMain() — user code begins

  

CreateProcess Stages

CreateProcessW (or CreateProcessA) takes 10 parameters. The critical ones for detection:

Important Creation Flags

STARTUPINFO and Handle Inheritance

The STARTUPINFO structure controls several aspects of the child process's initial state. For malware, the most important use is handle inheritance — passing file handles, pipe handles, or other kernel object handles to the child process.

// Create a child process with a pipe handle for C2 communication
HANDLE hReadPipe, hWritePipe;
SECURITY_ATTRIBUTES sa = {sizeof(sa), NULL, TRUE};  // bInheritHandle=TRUE
CreatePipe(&hReadPipe, &hWritePipe, &sa, 0);

STARTUPINFOA si = {};
si.cb = sizeof(si);
si.dwFlags = STARTF_USESTDHANDLES;
si.hStdInput  = hReadPipe;   // child reads from this pipe (attacker writes)
si.hStdOutput = hWritePipe;  // child writes to this (attacker reads)
si.hStdError  = hWritePipe;

PROCESS_INFORMATION pi;
CreateProcessA(NULL, "cmd.exe", NULL, NULL,
    TRUE,  // bInheritHandles = TRUE — passes pipe handles to child
    CREATE_NO_WINDOW, NULL, NULL, &si, &pi);
// Now we have a hidden cmd.exe communicating over pipes

Kernel-Side: What PspCreateProcess Does

At the kernel level, NtCreateUserProcess calls internal routines that:

1. Open the image file: The executable path is resolved to a file object. The file is opened and the image section is created (a section object backed by the PE file).
2. Allocate EPROCESS: The process executive object is allocated from the kernel pool and initialized.
3. Create virtual address space: A new page directory is created — the clean address space for the new process.
4. Map the image: The executable's sections are mapped into the new address space at ImageBase (or a random ASLR address). ntdll.dll is also mapped.
5. Create PEB: The Process Environment Block is created in the new process's user-mode address space.
6. Copy handle table: If bInheritHandles=TRUE, inheritable handles from the parent's handle table are copied.
7. Create initial thread: ETHREAD is allocated; the thread's start address is set to ntdll!LdrInitializeThunk (not the PE's entry point — the loader runs first).
8. Fire process creation callbacks: PsSetCreateProcessNotifyRoutineEx callbacks are called — this is where EDR drivers see the new process.

Process Creation Callbacks (EDR Hook Point)

The Windows kernel provides a callback registration mechanism that EDR drivers use to monitor process creation:

// Kernel driver registers a callback for process creation/termination
// Called in the context of the thread that created the process

VOID ProcessNotifyCallback(
    PEPROCESS  Process,      // new process's EPROCESS
    HANDLE     ProcessId,    // new process's PID
    PPS_CREATE_NOTIFY_INFO CreateInfo  // non-NULL = create, NULL = terminate
) {
    if (CreateInfo) {
        // Process is being created
        PUNICODE_STRING imgPath = CreateInfo->ImageFileName;
        PUNICODE_STRING cmdLine = CreateInfo->CommandLine;
        HANDLE parentPid = CreateInfo->ParentProcessId;
        // Log: new PID, image path, command line, parent PID
        // This is exactly what Sysmon Event ID 1 captures
    }
}

// Register at driver load time:
PsSetCreateProcessNotifyRoutineEx(&ProcessNotifyCallback, FALSE);

This callback fires for every new process. The CreateInfo struct includes the image path, command line, and parent PID — the core data in Sysmon Event ID 1. Because this is a kernel callback, it cannot be bypassed by hooking user-mode APIs. However, some techniques can influence the data seen by the callback.

Malware Process Creation Patterns

Q & A