Process creation is the event in which an operating system starts a new program or task. Security tools can record which process started, its parent process, command-line arguments, user account, and time. This helps defenders distinguish normal activity from unusual behavior.
In web-server investigations, an unexpected child process launched by a PHP worker may indicate that a request triggered a command or script. It is a useful signal, not proof of compromise: maintenance jobs and application features can also start processes. Defenders can compare process activity with expected service behavior and correlate it with web logs, file changes, and outbound connections to determine whether a probe led to execution.