Process creation search order is the sequence Windows follows when a program starts another executable by name only, without a full path such as C:\Windows\System32\tool.exe. The operating system checks a set of locations in order, which can include the application directory, the current working directory, system folders, and other path entries before it finds a match.
This matters because attackers can abuse it for binary shadowing and current-directory hijacking. If a trusted application launches git.exe or another helper by bare name, a malicious copy with the same name in the repository or working folder may run instead. Defenders reduce this risk by using fully qualified paths, restricting writable search locations, validating which executable is resolved, and avoiding reliance on the current directory for security-sensitive process launches.