Shai-HuludS9008 ↗
Has augmented its installation process by having its original install process exit cleanly to provide the user with the illusion that the service is installed normally.12
- Tactic
- Stealth
- Platforms
- Linux, macOS
- Version
- 2.0
- Created
- 27 September 2023
- Last modified
- 12 May 2026
- Contributor
- Tim (Wadhwa-)Brown
An adversary may attempt to evade process tree-based analysis by modifying executed malware's parent process ID (PPID). If endpoint protection software leverages the “parent-child" relationship for detection, breaking this relationship could result in the adversary’s behavior not being associated with previous process tree activity. On Unix-based systems breaking this process tree is common practice for administrators to execute software using scripts and programs.[1]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
0
Threat groupsNone recorded
Threat groupsNone recorded · 29% of ATT&CK techniques have none either.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.2
Tools & malware51st pct
Tools & malware51st percentile · 51% of ATT&CK techniques have this many tools implementing them or fewer.2
Detection rules50th pct
Detection rules50th percentile · 50% of ATT&CK techniques have more detection rules written.Break Process Trees MITRE reference T1036.009
51st pctamong all ATT&CK techniques for number of tools
2 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
BPFDoorS1161 ↗
After initial execution, BPFDoor forks itself and runs the fork with the --init flag, which allows it to execute secondary clean up operations. The parent process terminates leaving the forked process to be inherited by the legitimate process init.1
All 2 software entries for this technique
Offense vs defense T1036.009
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 0Sigma rules (cumulative) · 0Splunk ESCU (cumulative) · 2
first rule: 2022 Q4Break Process Trees detection strategy DET0443
MITRE names one behaviour worth catching for this technique and breaks it into 2 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection Strategy for Masquerading via Breaking Process Trees
2 platforms
AN1223 · Linux
Detects anomalous process execution patterns where a process's parent terminates quickly after process creation or is re-parented to 'init' (PID 1), often indicating double-fork or daemon-style detachment. These behaviors sever the parent-child relationship and obscure the execution origin in process tree analysis.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| OS API ExecutionDC0021 | auditd:SYSCALL | fork/clone/daemon syscall tracing |
| Process CreationDC0032 | auditd:SYSCALL | execve of re-parented process |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TimeWindow | Maximum time between parent and child process creation and parent process termination |
| ReparentingDetectionScope | Scope for detecting unexpected re-parenting to init/systemd |
| ExecutableScope | Subset of monitored executables or services likely to abuse double-fork |
AN1224 · macOS
Detects execution patterns where a child process is detached from its original parent, often showing up under 'launchd' (PID 1) with no parent lineage. These breakages in the process tree are indicative of evasive techniques using daemon(), fork() or background execution flags.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| OS API ExecutionDC0021 | fs:fsusage | Detached process execution with no associated parent |
| Process CreationDC0032 | macos:unifiedlog | Process creation with parent PID of 1 (launchd) |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| AnomalyParentPID | Triggering PID used to flag abnormal child adoption (commonly PID 1) |
| AllowedServices | Allowlist of background daemons legitimately using launchd as parent |
| ProcessNameEntropy | Entropy score threshold for abnormal process names in detached state |