Wrong Parent

Normal and Suspicious

A clean machine sits beside a suspicious one, and the pointer marks where to look.

How to Confirm It

Work through these in order. Each step names the page that shows how.

1. Rebuild the chain from creation records joined on unique process ids, Sysmon's ProcessGuid or Defender's ProcessUniqueId, never on PIDs. The records name the launcher even after it exits.Process Trees and Call Chains
2. In a live view or a memory image, compare the parent's start time with the child's. A parent that started later than its child is a reused PID, not the real parent. System is the exception, because its PID is always 4, so it never passes to another process.Process Trees and Call Chains
3. Treat any other orphan as a lead, and find the launcher that started it, and has since exited, in the creation records.Process Trees and Call Chains
4. Check the child's path, account and signer against its profile. Each one that differs is a sign of its own.Process Listings and Scans
5. Read the command lines of the child and its parent, which say what the shell was told to run, if anything.Command Line and Environment

What Defenders See

Each record names its log and what must be switched on to get it.

False Positives

User Account Control gives an elevated process the program that asked for it as its parent, though SYSTEM created it, so a recorded parent is not always the creator.

Live views show csrss.exe, wininit.exe, winlogon.exe and explorer.exe with no parent, because the copy of smss.exe or the userinit.exe that started them has exited.

Blind Spots

A parent can be named on purpose at creation. Event 4688 in the Security log, Sysmon event 1 and a memory image all keep that claim, as Parent Process Spoofing explains.

Win32_Process's ParentProcessId and windows.pstree link a child to whatever holds its recorded parent PID now, with no time check, so a reused PID shows a wrong parent.

Hunt It

The same hunt is written for four tools, so pick the one you use. Defender XDR and Sentinel queries are in KQL, which you paste into Advanced hunting in the Defender portal or into Sentinel's Logs page. Splunk queries are in SPL, for its Search page, and Velociraptor queries are in VQL, which you run as a hunt.

// Core processes created by a parent that never starts them (an lsass.exe clone included), and shells under core or remote execution parentsDeviceProcessEvents| where Timestamp > ago(30d)| extend Child = tolower(FileName), Parent = tolower(InitiatingProcessFileName)| where Child != Parent or Child == "lsass.exe"| where (Child in ("services.exe", "lsass.exe", "lsaiso.exe") and Parent != "wininit.exe")    or (Child in ("wininit.exe", "winlogon.exe") and Parent != "smss.exe")    or (Child == "csrss.exe" and Parent !in ("smss.exe", "svchost.exe"))    or (Child == "svchost.exe" and Parent !in ("services.exe", "msmpeng.exe"))    or (Child == "spoolsv.exe" and Parent != "services.exe")    or (Child == "userinit.exe" and Parent !in ("winlogon.exe", "dwm.exe"))    or (Child in ("cmd.exe", "powershell.exe", "pwsh.exe")        and Parent in ("lsass.exe", "spoolsv.exe", "winlogon.exe", "services.exe", "psexesvc.exe", "wmiprvse.exe", "wsmprovhost.exe"))| project Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessParentFileName, AccountName, ProcessCommandLine| order by Timestamp desc

In a Memory Image

Volatility 3 reads a memory image, and each of its plugins below shows part of this sign.

• windows.pstree (documentation, opens in a new tab)Memory Image A Volatility 3 plugin. It is one check run on a saved copy of a Windows machine's memory. pstree means process tree. The tree by recorded parent PID, from the active list. Exited launchers are missing, and a reused PID can show a wrong parent.
• windows.pslist (documentation, opens in a new tab)Memory Image A Volatility 3 plugin. It is one check run on a saved copy of a Windows machine's memory. pslist means process list. Each process's PID, parent PID and create time. A parent created after its child is a reused PID, except for System.
• windows.psscan (documentation, opens in a new tab)Memory Image A Volatility 3 plugin. It is one check run on a saved copy of a Windows machine's memory. psscan means process scan. May still find launchers that have exited, such as the session copies of smss.exe, with their exit times.

Rules to Compare With

Security vendors publish detection rules anyone can read. These look for the same thing, so compare your own with them.

How to Prevent It

Each control helps prevent it, and its line says what it does here.

• ASR: Block process creations originating from PSExec and WMI commands (opens in a new tab) Blocks processes started through PsExec and WMI, the remote execution parents of a SYSTEM shell like the one on ws-042.
• ASR: Block all Office applications from creating child processes (opens in a new tab) Stops Word, Excel and the other Office apps starting child processes, so a document cannot be the start of a shell.
• Audit Process Creation (opens in a new tab) Writes event 4688 in the Security log with each new process's creator, so a wrong parent can be seen at all. Check it in the Registry: Advanced Audit Policy

Related

Where It Matters Most

• smss.exe Any parent but System, or smss.exe for a session copy, or a child it never starts, such as a shell.
• csrss.exe A running parent that started before it, or a child beyond the error reporting tools, conhost.exe and a few others.
• wininit.exe A running parent that started before it, or a child such as a shell that no detection rule expects.
• services.exe Any parent but wininit.exe, or a child that no installed service names.

See Them in the Tree

On ws-042, 12 Oct 2026

Open it in the tree: cmd.exeSuspiciousOpen it in the tree: scvhost.exeSuspicious

Travels with

• Parent Process Spoofing A recorded parent can be set on purpose, so when one looks wrong, test the record as well as the process.
• Wrong Account A shell under a service can run as SYSTEM in session 0 too, as the prompt on ws-042 did, so read its account as well.

Check It in the Registry

Image File Execution OptionsSilent Process Exit

Sources

• MITRE ATT&CK T1134.004: Access Token Manipulation: Parent PID Spoofing (opens in a new tab)
• Elastic: Unusual Parent-Child Relationship (prebuilt rule) (opens in a new tab)
• Microsoft Learn: 4688(S) A new process has been created (opens in a new tab)
• Microsoft Learn: Win32_Process class (ParentProcessId and reused process ids) (opens in a new tab)
• Microsoft Learn (archived blog): How to troubleshoot high CPU in the System process (its PID is always 4) (opens in a new tab)
• Microsoft Sysinternals: Sysmon (process GUIDs survive reused PIDs) (opens in a new tab)
• Microsoft Learn: MSGina.dll features (Userinit starts the shell) (opens in a new tab)
• Microsoft Tech Community (Ask the Performance Team): WS2008: Terminal Services Architecture (userinit.exe starts the shell, then exits) (opens in a new tab)
• Microsoft Tech Community (Ask the Performance Team): WS2008: Startup Processes and Delayed Automatic Start (each session's smss.exe copy) (opens in a new tab)
• SigmaHQ: PsExec Service Execution (the service binary in C:\Windows) (opens in a new tab)
• Velociraptor: Windows.Attack.ParentProcess (opens in a new tab)
• Volatility 3: windows.pstree (opens in a new tab)