--- title: Who launched that process? | daily.dev description: YARA-X now exposes process lineage inside VirusTotal's vt module for Livehunt rules. Version 1.21.0 adds a parent_name field to vt.behaviour.processes_list,... canonical: https://daily.dev/posts/who-launched-that-process--b18oebtdq twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Who launched that process? | daily.dev og:description: YARA-X now exposes process lineage inside VirusTotal's vt module for Livehunt rules. Version 1.21.0 adds a parent_name field to vt.behaviour.processes_list,... og:url: https://daily.dev/posts/who-launched-that-process--b18oebtdq og:image: https://api.daily.dev/og/posts/b18OeBTDQ.png og:image:alt: Who launched that process? og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Who launched that process? **[YARA-X](https://daily.dev/sources/yara-x)** · 4 min read · 0 upvotes · 0 comments ## Summary YARA-X now exposes process lineage inside VirusTotal's vt module for Livehunt rules. Version 1.21.0 adds a parent_name field to vt.behaviour.processes_list, and 1.22.0 adds ancestor_names, listing ancestors nearest first. Previously the recursive process tree couldn't be represented in Protocol Buffers, so rules only had flat lists like processes_created with no parent information. Rules can now check parent or grandparent names directly, loop over ancestor_names to detect any ancestor like winword.exe, or match a process against files its own parent wrote. Both fields are available in Livehunt and in Retrohunt for recently analyzed files. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How can I check if a process was launched by a specific parent process in a YARA Livehunt rule? Use the parent_name field added to vt.behaviour.processes_list items in YARA-X v1.21.0. It holds the name of the process that created the current one, empty for root processes or when the parent is unknown, letting a rule check 'was schtasks.exe launched by cmd.exe' with a single loop over the process list. _Developers writing sandbox-based detection rules can track YARA-X module updates like this on daily.dev._ ### How do I detect if a specific ancestor process, like winword.exe, appears anywhere up a process chain in YARA-X? Use the ancestor_names field added in YARA-X v1.22.0, which lists ancestors nearest first (ancestor_names[0] is the parent, ancestor_names[1] the grandparent). Loop over the array with something like 'for any a in p.ancestor_names : (a icontains "winword.exe")' to match when that process is anywhere among the ancestors, regardless of depth. _Anyone building malware detection rules can keep up with YARA-X module changes like this through daily.dev._ ### Why can't YARA directly represent a recursive process tree from a sandbox report? YARA-X modules are defined with Protocol Buffers, which do not support recursive messages, so there is no way to iterate over a structure of unknown depth like a process tree. VirusTotal works around this by flattening the tree into vt.behaviour.processes_list, giving each entry a parent_name and ancestor_names instead of nested children. _Security engineers evaluating YARA-X's data model limitations can follow module updates on daily.dev._ ## Similar posts on daily.dev - [Schneier on Security](https://daily.dev/posts/schneier-on-security-siybltgzo) · Schneier on Security · 0 upvotes · 0 comments - [Beware of the wildcard](https://daily.dev/posts/beware-of-the-wildcard-cnnz5ig83) · YARA-X · 0 upvotes · 0 comments - [Build your own vulnerability harness](https://daily.dev/posts/build-your-own-vulnerability-harness-qm0qjudbn) · Cloudflare · 4 upvotes · 0 comments - [I keep building tools that catch software lying about whether it works](https://daily.dev/posts/i-keep-building-tools-that-catch-software-lying-about-whether-it-works-szjgd6ux5) · Medium · 0 upvotes · 1 comments - [A proactive defense against npm supply chain attacks](https://daily.dev/posts/a-proactive-defense-against-npm-supply-chain-attacks-hy7knvkqx) · InfoWorld · 0 upvotes · 0 comments --- Tags: [#backend](https://daily.dev/tags/backend), [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/who-launched-that-process--b18oebtdq) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Who launched that process?","url":"https://daily.dev/posts/who-launched-that-process--b18oebtdq","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/who-launched-that-process--b18oebtdq"},"datePublished":"2026-10-26T13:57:12.996Z","dateModified":"2026-10-26T13:57:38.037Z","description":"YARA-X now exposes process lineage inside VirusTotal's vt module for Livehunt rules. Version 1.21.0 adds a parent_name field to vt.behaviour.processes_list,...","image":"https://media.daily.dev/image/upload/s--P4t4XyoV--/f_auto/v1722860399/public/Placeholder%2001","thumbnailUrl":"https://media.daily.dev/image/upload/s--P4t4XyoV--/f_auto/v1722860399/public/Placeholder%2001","isAccessibleForFree":true,"articleSection":"YARA-X","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"YARA-X","logo":"https://media.daily.dev/image/upload/s--PuWW0skn--/f_auto,q_auto/v1787487499/logos/yara-x?_a=BAMAMicg0","url":"https://daily.dev/sources/yara-x"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/who-launched-that-process--b18oebtdq","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"backend,malware","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"YARA-X","item":"https://daily.dev/sources/yara-x"},{"@type":"ListItem","position":3,"name":"Who launched that process?"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/who-launched-that-process--b18oebtdq#faq","mainEntity":[{"@type":"Question","name":"How can I check if a process was launched by a specific parent process in a YARA Livehunt rule?","acceptedAnswer":{"@type":"Answer","text":"Use the parent_name field added to vt.behaviour.processes_list items in YARA-X v1.21.0. It holds the name of the process that created the current one, empty for root processes or when the parent is unknown, letting a rule check 'was schtasks.exe launched by cmd.exe' with a single loop over the process list. Developers writing sandbox-based detection rules can track YARA-X module updates like this on daily.dev."}},{"@type":"Question","name":"How do I detect if a specific ancestor process, like winword.exe, appears anywhere up a process chain in YARA-X?","acceptedAnswer":{"@type":"Answer","text":"Use the ancestor_names field added in YARA-X v1.22.0, which lists ancestors nearest first (ancestor_names[0] is the parent, ancestor_names[1] the grandparent). Loop over the array with something like 'for any a in p.ancestor_names : (a icontains \"winword.exe\")' to match when that process is anywhere among the ancestors, regardless of depth. Anyone building malware detection rules can keep up with YARA-X module changes like this through daily.dev."}},{"@type":"Question","name":"Why can't YARA directly represent a recursive process tree from a sandbox report?","acceptedAnswer":{"@type":"Answer","text":"YARA-X modules are defined with Protocol Buffers, which do not support recursive messages, so there is no way to iterate over a structure of unknown depth like a process tree. VirusTotal works around this by flattening the tree into vt.behaviour.processes_list, giving each entry a parent_name and ancestor_names instead of nested children. Security engineers evaluating YARA-X's data model limitations can follow module updates on daily.dev."}}]} ```