Suspicion falls on Malcolm and Donalbain for the murder of their father, King Duncan, because they run away after Duncan's body is found. They run, however, because they realize that as Duncan's heirs, their lives, too, are most likely in danger. Donalbain tells his brother they should flee immediately, even before they have had time to mourn their father:
What should be spoken here,
Where our fate, hid in an auger-hole,
May rush, and seize us? Let's away:
Our tears are not yet brewed.
Agreed, they do leave, with Malcom going to England and Donalbain to Ireland. By separating, they are individually safer. As they part, Donalbain sums up their situation:
Where we are
There's daggers in men's smiles; the near in blood,
The nearer bloody.
When they are discovered missing the morning after the murder, guilt immediately shifts to them simply because they have left without explanation. It is Macduff who gives this news to Ross in Act II.
This is a good question because Macbeth and Lady Macbeth go to some trouble to frame Duncan's guard's for the murder. In Act II, scene ii, after Macbeth has committed the murder, Lady Macbeth plants the bloody daggers on the drunk guards and smears them with the king's blood.
Give me the daggers [...]
I'll gild the faces of the grooms withal
For it must seem theit guilt
Then, before they can defend themselves, Macbeth kills them. See Act II, scene iii.
Malcolm, as Prince of Cumberland is next in line for the throne and is therefore in danger. of being assinated because he is now the new king. He is also a suspect in the kings death and running away,although it keeps him safe, makes him appear guilty.