CmdID / Techniques / T1134

T1134.004 Access Token Manipulation: Parent PID Spoofing

Adversaries may spoof the parent process identifier (PPID) of a new process to evade process-monitoring defenses or to elevate privileges. MITRE ATT&CK

1 Sigma rule T1134.004 on attack.mitre.org

Part of

MITRE ATT&CK

T1134Access Token Manipulation

Sigma rules tagged with it

process creation, the highest levels first

highHackTool - PPID Spoofing SelectMyParent Tool ExecutionFlorian Roth (Nextron Systems) · Windows