Windows Process Behaviour Encyclopedia

Normal vs suspicious behaviour for every critical Windows process. Stop Googling "is svchost.exe with this parent normal?" during an incident. Every process documented with expected parents, children, network behaviour, and red flags.