On the contrary, an intruder who tries to exploit system bugs to enter the network will
want to try to open a shell, or compile a program, install a new server, create a new user, etc.
In order to achieve such goals, s/he will inevitably have to generate some new processes.