searchindexer.exe

SearchIndexer.exe crawls files, email, and other content and stores a searchable index, so that queries return instantly instead of scanning the disk each time. It is the WSearch service, started by services.exe and running as NT AUTHORITY\SYSTEM from C:\Windows\System32\SearchIndexer.exe. Its normal children are SearchProtocolHost.exe and SearchFilterHost.exe, the helpers that open and parse content for indexing.

Legitimately, SearchIndexer runs all the time and can use noticeable disk and CPU while catching up on indexing. Its known helper children are expected. Anything else is not.

SearchIndexer.exe is largely a baseline. As an always-running SYSTEM service it is a candidate for code injection (T1055), where implanted code inherits its privileges and blends into normal indexing activity, so unusual loaded modules, network connections, or unexpected child processes are what would point to abuse.

Its trusted name also makes it an impersonation target (T1036.005): a SearchIndexer.exe outside System32, with the wrong parent, or running as the wrong account is the deviation to investigate.