Method StackPID

pkg/event/event_windows.go:268–276

StackPID returns the process id as seen the creator from the callstack execution perspective. For example, the pid associated with CreateProcess events is the parent, not the process being created.

()

// the pid associated with CreateProcess events is the
// parent, not the process being created.
func (e *Event) StackPID() uint32 {
	if e.IsCreateProcess() {
		if e.IsSurrogateProcess() {
			return e.Params.MustGetUint32(params.ProcessRealParentID)
		}
		return e.Params.MustGetPpid()
	}
	return e.PID
}

// IsCreateRemoteThread indicates if the remote thread creation occurred.
func (e *Event) IsCreateRemoteThread() bool {