Method and apparatus to identify creator of com process created using ole automation

At least one non-transitory computer-readable medium comprising computer-readable instructions to cause at least one processor circuit to at least:

• analyze a first event message from an event log, the first event message including a first ID of a first event and a first timestamp;
• analyze a second event message from an event log, the second event message including a second ID of a second event and a second timestamp, the second ID different than the first ID and the second timestamp after the first timestamp;
• identify a second process based on the second event message;
• determine that the second process was created by a component object model (COM) call, at least in part based on the second ID;
• determine that a first process initiated the COM call, at least in part based on the first event message and the second event message;
• and
• execute a malware scan of a parent of the first process, at least in part based on the determination that the first process initiated the COM call.

A method implemented by a computing device, the method comprising:

• capturing a first event message for a first event in an event log, the first event message including a first ID of the first event, and a first timestamp;
• capturing a second event message for a second event in the event log, the second event message including a second ID of the second event, the second ID different than the first ID, and a second timestamp occurring after the first timestamp;
• identifying a second process based on the second event message;
• determining that the second process was created by a component object model (COM) call, at least in part based on the second ID;
• determining that a first process initiated the COM call, at least in part based on the first event message and the second event message;
• and
• executing a malware scan of a parent of the first process, at least in part based on the determination that the first process initiated the COM call.