Process

The kernel represents each process with a control block (task_struct in Linux, EPROCESS in Windows) holding its identifier, state, scheduling data, a pointer to its page tables, the table of open file descriptors or handles, signal or exception handlers, resource limits and the security context: real and effective UID/GID plus capabilities on Linux, or an access token with user and group SIDs, privileges and an integrity level on Windows. The address space is typically laid out as program text, data and BSS, heap, memory-mapped libraries and a stack per thread, randomised by ASLR. Threads share the address space and handles of their process but have their own registers and stack, which is why a process, not a thread, is the unit of isolation.

Unix creates processes in two steps: fork() duplicates the caller, cheaply thanks to copy-on-write pages, and execve() replaces the image with a new program while keeping open descriptors not marked close-on-exec, a common source of leaked file handles into child processes. Windows combines both in CreateProcess, and the parent can choose to pass a different token, which is how services launch work as another user. Every process except the first has a parent (PID 1 on Linux is init, today usually systemd). A terminated child whose exit status has not been collected with wait() remains as a zombie; orphans are re-parented to init or a designated subreaper. The scheduler moves processes between running, ready and blocked states and performs context switches, saving and restoring register state and, when switching address spaces, the page-table base.

Security follows from inheritance: a child normally inherits the credentials of its parent, so whatever a user can do, any program they start can do. Controls act on that chain. Privilege escalation means obtaining a process with a stronger token (setuid binaries, sudo, UAC elevation, token theft). Sandboxing narrows what a process can reach with seccomp filters, AppArmor or SELinux domains, Windows AppContainers or Job objects. Linux namespaces and cgroups give a process tree its own view of PIDs, mounts, network and users, plus resource limits, which is all a container is.

Detection engineering relies heavily on process telemetry. Windows event 4688 and Sysmon event 1 record process creation with command line and parent; EDR products watch for suspicious parent-child pairs such as winword.exe spawning powershell.exe. Attackers respond with techniques catalogued in MITRE ATT&CK T1055 (Process Injection), including process hollowing (T1055.012), where a legitimate process is started suspended and its memory replaced, and with living-off-the-land binaries that make malicious activity look like ordinary system processes. A process differs from a program (the file on disk), from a thread (a unit of execution inside it) and from a service, which is a process managed by the service manager rather than started interactively.