ghost process detector

drop 4688 and 4689 evtx csv or sysmon evtx csv · detect processes that started with no exit record · identify orphaned process tree nodes · surface attacker processes that evaded exit logging · runs locally