A security service system for identifying a suspicious activity, the security service comprising: one or more processors; and memory coupled to the one or more processors, the memory including a plurality of modules communicatively coupled to each other and executable by the one or more processors, the plurality of modules comprising: a data module configured to store known patterns, the known patterns including known suspicious activity patterns and known indicators of attack (IoAs); a monitoring module configured to receive monitored data in a process running on a monitored computing device; and an identification module configured to identify one or more suspicious activity patterns based on a comparison between the received monitored data and the known patterns, characterized in that: the plurality of modules further comprises a determination module configured to determine an ancestry level of an ancestry command and to determine whether the ancestry level of the ancestry command is different from an expected ancestry level of the ancestry command for a trigger command, the identification module is further configured to identify the trigger command in the process running on the monitored computing device and to identify the ancestry command associated with the trigger command, and the data module is further configured to store information associated with the trigger command, the ancestry command, and the ancestry level of the ancestry command as a new suspicious activity pattern. one or more processors; and memory coupled to the one or more processors, the memory including a plurality of modules communicatively coupled to each other and executable by the one or more processors, the plurality of modules comprising: a data module configured to store known patterns, the known patterns including known suspicious activity patterns and known indicators of attack (IoAs); a monitoring module configured to receive monitored data in a process running on a monitored computing device; and an identification module configured to identify one or more suspicious activity patterns based on a comparison between the received monitored data and the known patterns, a data module configured to store known patterns, the known patterns including known suspicious activity patterns and known indicators of attack (IoAs); a monitoring module configured to receive monitored data in a process running on a monitored computing device; and an identification module configured to identify one or more suspicious activity patterns based on a comparison between the received monitored data and the known patterns, characterized in that: the plurality of modules further comprises a determination module configured to determine an ancestry level of an ancestry command and to determine whether the ancestry level of the ancestry command is different from an expected ancestry level of the ancestry command for a trigger command, the identification module is further configured to identify the trigger command in the process running on the monitored computing device and to identify the ancestry command associated with the trigger command, and the data module is further configured to store information associated with the trigger command, the ancestry command, and the ancestry level of the ancestry command as a new suspicious activity pattern. the plurality of modules further comprises a determination module configured to determine an ancestry level of an ancestry command and to determine whether the ancestry level of the ancestry command is different from an expected ancestry level of the ancestry command for a trigger command, the identification module is further configured to identify the trigger command in the process running on the monitored computing device and to identify the ancestry command associated with the trigger command, and the data module is further configured to store information associated with the trigger command, the ancestry command, and the ancestry level of the ancestry command as a new suspicious activity pattern.