Malcolm was in the castle when his father King Duncan was killed.  His brother Donalbain was also there, but Malcolm is the older brother.  In fact, since Malcolm is next in line to be king, he would be the number one suspect.  Unfortunately, Malcolm and Donalbain flee before anyone can ask them anything, making them look guiltier than ever.

An investigator looking into Duncan’s murder would naturally start with Malcolm.  The first question should be: Are you next in line to be king?  The answer is yes!

The investigator would likely remind Malcolm what Duncan said.

Sons, kinsmen, thanes,

And you whose places are the nearest, know

We will establish our estate upon

Our eldest, Malcolm, whom we name hereafter

The Prince of Cumberland; (1:4)

Yet a good investigator would also ask who was present at this announcement, and how they reacted.  A person might have noticed that Macbeth seemed disturbed.  He even mumbled to himself.

[Aside.] The Prince of Cumberland! That is a step(55)

On which I must fall down, or else o'erleap,

For in my way it lies. Stars, hide your fires;

Let not light see my black and deep desires(1:4)

So asking the right question makes all the difference.  The investigator that asked this question would know to look at Macbeth as a suspect.

Another important question might be who else is in line for the throne after Malcolm.  The answer seems more likely to be his brother Donalbain, because Donalbain also flees.