Process lineage is the parent-child relationship between running processes on a system. Every new process is usually started by another process, creating a chain that security tools can map as a process tree. Analysts use this lineage to see not just what ran, but what launched it, with what arguments, and in what sequence.
It matters because attackers often hide malicious activity inside normal-looking tools such as PowerShell, installers, or remote-access software. A suspicious lineage might show a document or browser spawning a script host, which then starts a downloader or remote-control agent. That pattern is often more revealing than the file name alone. Defenders watch for unusual parent processes, unexpected child processes, and script chains that do not match approved administration. In practice, process lineage helps separate legitimate IT automation from intrusion activity and makes staged attacks easier to detect and investigate.