Process ancestry is the chain of parent and child processes on a system: which program started another program, and which process started that one before it. In Windows security monitoring, this lineage helps explain how activity began and whether it matches normal user behavior. A document opening a script, a script launching a system utility, or a browser spawning an unexpected child process can all be important clues.
It matters because many attacks hide inside trusted software and legitimate workflows. Malware often uses Office documents, scheduled tasks, or browsers to blend in, so a suspicious binary name alone is not enough. Defenders use process ancestry in endpoint detection, SIEM rules, and incident response to spot abnormal chains, such as a Word document creating PowerShell or a browser starting a command shell. When the parent-child sequence is wrong, the behavior is often more revealing than the payload itself.