What should be preserved about active sessions and processes?¶

Active sessions and processes may show who or what is currently using a system, but they are volatile and context-dependent.

Avoid this assumption: A visible username or process name proves who is responsible. Sessions may be shared, compromised, automated or controlled remotely.

Record the system, account, date, time, time zone and page or tool displaying the information.

Capture usernames, session names, login times, source addresses, device labels, authentication method and session IDs where visible.

For processes, preserve the process name, identifier, parent process, user account, start time, path, command line and current status where shown.

Record whether a session is local, remote, administrative, service-based, interactive, disconnected or still active.

Capture any remote desktop, VPN, command shell, virtual machine or container context.

Do not terminate sessions, stop processes or log users out merely to make the system safe without understanding the consequence.

Those actions may destroy unsaved data, memory evidence, command history or visibility of the attacker.

Where malware or active harm is suspected, seek incident-response support quickly.

If a process or session must be ended, record its full visible details first where practicable and document the exact time, reason and result.

Do not infer human attribution from an account or process label alone.

Preserve whether each process or session appears user-initiated, system-generated, scheduled or controlled through another host.

Record any associated executable path, service name or remote host.

Operational takeaway¶

Preserve session and process identifiers, timing, user context and relationship before termination, while keeping technical activity separate from personal attribution.