Log Investigation Event 1:

Objective: Investigate a suspicious parent-child process alert using Splunk and Sysmon telemetry, determine whether the activity represents malicious behavior, and document the analytical findings.

Figure 1 – Initial TryHackMe alert

Figure 2 – Splunk investigation and cross-host comparison

Summary Report:

Time of Activity: 10/03/2026 16:56:06.842

List of Related Entities: host.name: win-3459

process.name: TrustedInstaller.exe

process.pid: 3577

process.parent.pid: 3506

process.parent.name: services.exe

process.command_line: C:\Windows\servicing\TrustedInstaller.exe

process.working_directory: C:\Windows\system32\

event.action: Process Create (rule: ProcessCreate)

Reason for Classifying as False Positive: Splunk investigation showed services.exe spawning TrustedInstaller.exe from the legitimate Windows path C:\Windows\servicing\TrustedInstaller.exe. The same parent-child relationship was observed on another host, win-3449, with consistent process behavior. No evidence was identified linking this specific TrustedInstaller.exe process execution to malicious activity. Based on the available evidence, this alert was classified as a false positive.

Splunk Investigation Queries:

host.name="win-3459"