taskmgr.exe

taskmgr.exe is the interactive process and performance monitor. It lists running processes and their resource use, can end or restart them, and shows services, startup programs, and logged-on users. It runs as the user who launched it, on demand, from C:\Windows\System32\Taskmgr.exe. It is normally started by the user through Ctrl+Shift+Esc or the taskbar.

Legitimately, taskmgr is opened interactively to check on the system, so an instance parented to explorer.exe and running as the logged-on user is exactly what is expected. How it was started, and what an account does with it, are what give an instance meaning.

taskmgr.exe is a built-in way to dump process memory (T1003.001). An operator with administrative rights can right-click lsass.exe in Task Manager and choose "Create dump file," producing a full memory dump that is then parsed offline to extract credentials, no third-party tool required. A lsass-named dump appearing in a temp or profile directory, especially around an interactive taskmgr session, is the pattern to catch.

Otherwise taskmgr is mostly a baseline. Its trusted name makes it an occasional impersonation target (T1036.005), so a taskmgr.exe outside System32, running as SYSTEM with no user present, or launched by a script host rather than the shell, is the deviation worth examining.