A child process chain is the sequence of programs started by one another on a system. For example, an email client may launch a script interpreter, which then starts a downloader, which finally runs the main payload. Security tools use this parent-child relationship to reconstruct what actually executed, not just what files were present.
This matters because modern attacks often hide in staged execution. A harmless-looking document, archive, or script can spawn several short-lived processes before the final malware appears. Defenders look for unusual chains, such as Office launching PowerShell, browsers starting scripts, or unexpected executables spawning network-aware tools. Spotting a suspicious child process chain can reveal phishing, droppers, and remote-access malware early, especially when file-based detection alone misses the full attack path.