During a forensics investigation of a detected ransomware incident on an endpoint, you review the timeline of events in the FortiEDR forensics module…

To trace the execution chain and identify the parent process that launched a malicious command, the process execution chain (or process tree) feature in the FortiEDR Forensics module must be used. This view visually maps the parent-child relationships of processes, allowing analysts to trace the origin of an attack, understand the execution context, and determine exactly which application or script spawned the malicious PowerShell instance. This is critical for understanding the root cause and delivery mechanism of the ransomware.

A. File Hash Lookup identifies if a file is known malware via threat intelligence, but it does not display the local execution chain or parent process.

B. Enabling behavior analysis is a proactive monitoring step for future events, not a forensic tool for tracing past execution chains.

D. Querying Network Connections identifies external C2 communications but does not reveal the local process execution chain or parent process.

1. Fortinet, "FortiEDR 5.x Administration Guide," Chapter: Forensics, Section: Process Tree Analysis, pp. 142-145.

2. Fortinet NSE 6 - FortiEDR Study Guide, Module: Forensics and Threat Hunting.