I recently installed Sysmon, which logs events to OSSEC and currently monitors several endpoints. I have been trying to whitelist benign processes such as Windows services. Many of these processes run with commandline arguments e.g.
svchost.exe -k netsvcs -p -s NetSetupSvc. However, an explanation of these commandline arguments is not available for many of these Windows processes when using /? in the command prompt e.g.
Is there documentation online that explains the commandline arguments of these Windows processes? It would also be useful if there is documentation indicating the parent process that spawns a specific Windows process.
The reason I am requesting this information is so that I can whitelist a Windows process using its process name, commandline arguments and parent process. I do not want to whitelist a process by only using its process name as this would not detect malware which uses the same name.