Discussion in the Daily Dave mailing list (Immunity) about process creation monitoring and its value from a defensive point of view.