Elastic EQL

process where process.name == "cmd.exe" and process.parent.name == "winword.exe"

Elastic EQL query that correlates processes by their parent-child relationship, detecting execution from Office (macro) or from unexpected processes.

Run it when you want to detect chained execution: EQL (Event Query Language) expresses sequences and relationships between events — the example query looks for cmd.exe whose parent is winword.exe, the pattern of a malicious Office document macro. EQL allows what flat queries don't: parentage, temporal sequences, and correlations between processes. In Elastic Security, EQL rules are the way to detect execution chains (Office → cmd → powershell, or a legitimate process launching something unexpected) that individual event analysis doesn't see. It's the language for 'what launched this?' questions.

Don't use it if process telemetry doesn't include parentage: EQL depends on the agent recording parent.process.name — without Sysmon or Windows integration with the parent field, the query returns empty. EQL is powerful and limited at the same time: sequences require events to arrive ordered and in the same grouping key, and complex queries are hard to debug. For simple field correlation without temporal relationship, KQL or ES|QL are more straightforward. And watch out: EQL syntax (process where ...) is different from the rest of Elastic — syntax errors are common when starting; validate with Kibana's EQL editor before deploying the rule.