CCFH-202B: CrowdStrike Certified Falcon Hunter

TargetProcessId identifies the spawning process, while the spawned process records that process as its context. Thus, a child process’s ContextProcessId matches the parent process’s TargetProcessId. CrowdStrike’s process-correlation examples join ContextProcessId to TargetProcessId to relate activity to its responsible process.