parent-child process anomaly detector — free browser tool | fatcousin

drop 4688 evtx csv · static and dynamic parent-child baseline · lsass always critical · ranked table · runs locally

4688 csv

drop 4688 evtx csv

or click

Select file

static baseline + dynamic frequency (<5% of child occurrences)

drop 4688 evtx csv (process + parent required)