Parent Process Spoofing

What It Is

What Changes Inside the Process

The process is shown before and after, and the pointer marks what changed.

What It Leaves Behind

Which Evidence Can See It

Each tile says whether that kind of evidence can see it, and what it shows.

• Memory

  Partly

  A memory image holds only the recorded parent, so windows.pstree draws the child where it claims. A creator still holding a handle to that parent is a lead, not proof.

• EDR Telemetry

  Partly

  DeviceProcessEvents in Defender XDR records each start and its initiating process. Microsoft documents no column for a creator that differs from the recorded parent.

• Disk

  Cannot see

  No file records which process created another, so the disk holds nothing of the mismatch. Only the creator's own program, if it was dropped on the machine, is there to find.

• Logs

  Partly

  Event 4688 in the Security log and Sysmon event 1 name only the recorded parent. Where Sysmon logs process access, event 10 can show the creator opening that parent first.

How to Confirm It

Work through these in order. Each step names the page that shows how.

1. Compare the recorded parent with the real creator from creation-time telemetry. Use Kernel-Process ETW, as Velociraptor's Windows.ETW.DetectProcessSpoofing reads it, or an EDR that records it, such as Elastic Defend.Process Trees and Call Chains
2. Rule out User Account Control, because an elevated program's recorded parent is the program that asked for elevation, by design, not the service that started it.Process Trees and Call Chains
3. Look for the creator opening the named parent just before, in Sysmon event 10 where Sysmon runs, with GrantedAccess that includes PROCESS_CREATE_PROCESS (0x0080).Handles, Pipes and Mutexes
4. Read what the new process ran and what its real creator was doing. The false parent hides who started it, not what it did.Command Line and Environment

Investigation Steps With Named Tools

Each question has the tools that answer it on a running machine, and in a memory image, a copy of its memory saved to a file.

• Which process really created it?

  On a Running Machine

  • Windows.ETW.DetectProcessSpoofing (documentation, opens in a new tab)Live Machine A Velociraptor artifact. It is a ready-made question Velociraptor asks of running machines, named from general to specific. An exchange artifact, imported first and run as client event monitoring, that reports each start whose ClaimedParent differs from its RealParent. It sees only starts after it begins.
  • DeviceProcessEvents (documentation, opens in a new tab)Logs and Records A Defender XDR table. It holds the records Defender for Endpoint keeps of what happened on each machine, and you search it with KQL. The start, with InitiatingProcessFileName and its parent. Microsoft documents no separate creator column, so see what it names for an elevation before relying on it.
  • Windows.Attack.ParentProcess (documentation, opens in a new tab)Live Machine A Velociraptor artifact. It is a ready-made question Velociraptor asks of running machines, named from general to specific. A built-in artifact that flags parents outside its table of expected ones. A spoofed parent usually looks expected, so a clean result clears nothing.

  In a Memory Image

  • windows.pstree (documentation, opens in a new tab)Memory Image A Volatility 3 plugin. It is one check run on a saved copy of a Windows machine's memory. pstree means process tree. Each process under its recorded parent PID, so a spoofed child sits where it claims. It gives the parent to test, not the mismatch.
  • windows.psscan (documentation, opens in a new tab)Memory Image A Volatility 3 plugin. It is one check run on a saved copy of a Windows machine's memory. psscan means process scan. Exited processes too, with create and exit times, so a creator that telemetry names can be found after it closes.

• Which process held the recorded parent open?

  On a Running Machine

  • Windows.System.Handles (documentation, opens in a new tab)Live Machine A Velociraptor artifact. It is a ready-made question Velociraptor asks of running machines, named from general to specific. With every handle type unticked it lists all open handles, Process handles among them, and IncludeAccessMasks spells out each handle's access.
  • Defender for Endpoint live response (documentation, opens in a new tab)Live Machine Part of Defender for Endpoint. It opens a command console on one machine from the Defender portal, so you can list its processes from your desk. processes Its processes command shows whether the creator and the parent it named still run. No built-in command lists handles, so reach them through a read-only library script started with run.

  In a Memory Image

  • windows.handles (documentation, opens in a new tab)Memory Image A Volatility 3 plugin. It is one check run on a saved copy of a Windows machine's memory. The Process handles each process held at capture, with GrantedAccess. A closed handle leaves nothing, so pair it with Sysmon event 10.

What Defenders See

Each record names its log and what must be switched on to get it.

False Positives

User Account Control starts an elevated program from its own service and records the program that asked for elevation as its parent, which ATT&CK notes as the expected case.

Installers, updaters, application brokers, remote support tools and security agents start processes under another parent too. Elastic treats them as explanations to prove, not to assume.

Blind Spots

A memory image and a live listing hold only the recorded parent, so neither shows spoofing on its own. Pair them with creation-time telemetry.

Sysmon event 1 and 4688 record the parent the process claims, so trackers and rules built on them inherit the false parent.

Hunt It

The same hunt is written for four tools, so pick the one you use. Defender XDR and Sentinel queries are in KQL, which you paste into Advanced hunting in the Defender portal or into Sentinel's Logs page. Splunk queries are in SPL, for its Search page, and Velociraptor queries are in VQL, which you run as a hunt.

// explorer.exe started with /root, a pattern Splunk links to parent PID spoofingDeviceProcessEvents| where Timestamp > ago(30d)| where FileName =~ "explorer.exe" and ProcessCommandLine contains "/root,"| summarize Starts = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceName, InitiatingProcessFileName, ProcessCommandLine| order by Starts asc

In a Memory Image

Volatility 3 reads a memory image, and each of its plugins below shows part of this sign.

• windows.pstree (documentation, opens in a new tab)Memory Image A Volatility 3 plugin. It is one check run on a saved copy of a Windows machine's memory. pstree means process tree. The recorded parent PID only, so a spoofed child sits under the parent it claimed. It cannot show the mismatch.
• windows.handles (documentation, opens in a new tab)Memory Image A Volatility 3 plugin. It is one check run on a saved copy of a Windows machine's memory. A creator still holding a handle to the process it named. A closed handle leaves nothing, so pair it with Sysmon event 10.
• windows.cmdline (documentation, opens in a new tab)Memory Image A Volatility 3 plugin. It is one check run on a saved copy of a Windows machine's memory. cmdline means command line. What the child was told to run, whoever started it.

Rules to Compare With

Security vendors publish detection rules anyone can read. These look for the same thing, so compare your own with them.

How to Prevent It

Each control helps prevent it, and its line says what it does here.

• Sysmon (opens in a new tab) Run Sysmon with process access events for the right to create processes, beside process creation, so both halves of a spoofed start are on record.
• App Control for Business (opens in a new tab) Let only trusted code run, so a program that would name a false parent cannot start.

Related

Where It Matters Most

• explorer.exe A child recorded under it that something else created. Splunk flags explorer.exe started with /root.
• sihost.exe A child recorded under it that it did not create, apart from msedge.exe, a harmless case Elastic excuses.

Travels with

• Wrong Parent A spoofed parent usually looks right, so the parent check passes. The real creator is where the wrong parent hides.

Check It in the Registry

User Account Control Settings

Sources

• Microsoft Learn: Process Security and Access Rights (opens in a new tab)
• Microsoft Learn: DeviceProcessEvents table (opens in a new tab)
• Microsoft Learn: Live response in Defender for Endpoint (opens in a new tab)
• Microsoft Learn: About Event Tracing (opens in a new tab)
• Velociraptor: ETW Part 2, Process Parent Spoofing (opens in a new tab)
• Velociraptor: Windows.ETW.DetectProcessSpoofing (opens in a new tab)
• Velociraptor: Windows.System.Handles (opens in a new tab)
• Elastic: Parent Process PID Spoofing (opens in a new tab)
• Elastic Security Labs: Effective Parenting, detecting LRPC-based parent PID spoofing (opens in a new tab)
• Splunk: Windows Parent PID Spoofing with Explorer (opens in a new tab)