Peanut butter and jelly, wine and cheese — some things just go together. But httpd.exe paired with cmd.exe? Not so much. This talk covers anomalous process relationships that might include a potential exploit, along with a specific hunting technique used to uncover these processes that don’t belong together. We’ll show you how to use the security tech you already own to enhance the data used in this hunting technique.