A detached process is a child process that is started by another program but continues running independently after the parent exits or loses control. It may have its own session, console, or process group, which makes it less tied to the original application.
In cyber security, detached processes matter because they can hide the real payload behind a trusted parent. For example, a malicious IDE extension may launch Python as a detached child so the editor appears normal while the payload runs separately. This can bypass simple monitoring that only inspects the parent process and makes detection harder. Defenders look for unusual parent-child relationships, unexpected interpreter launches, command-line anomalies, and processes that survive after the original tool closes. Detachment is also used legitimately for background jobs and automation, so security teams must judge context carefully.