tfMITRE ATT&CK sub-technique

Parent PID Spoofing T1134.004

sub-technique of T1134 Access Token Manipulation

Tactics: Privilege Escalation, Stealth
Platform: Windows
Version: 2.0
Created: 18 February 2020
Last modified: 12 May 2026
Contributor: Wayne Silva, F-Secure Countercept

Adversaries may spoof the parent process identifier (PPID) of a new process to evade process-monitoring defenses or to elevate privileges. New processes are typically spawned directly from their parent, or calling, process unless explicitly specified. One way of explicitly assigning the PPID of a new process is via the CreateProcess API call, which supports a parameter that defines the PPID to use.[1] This functionality is used by Windows features such as User Account Control (UAC) to correctly set the PPID after a requested elevated process is spawned by SYSTEM (typically via svchost.exe or consent.exe) rather than the current user context.[2]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware62nd pct

Tools & malware62nd percentile · 62% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules54th pct

Detection rules54th percentile · 54% of ATT&CK techniques have this many detection rules written or fewer.

Parent PID Spoofing MITRE reference T1134.004

62nd pctamong all ATT&CK techniques for number of tools

4 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

DarkGateS1111 ↗

Relies on parent PID spoofing as part of its "rootkit-like" functionality to evade detection via Task Manager or Process Explorer.1

created 2024-02-09MALWARE

PipeMonS0501 ↗

Can use parent PID spoofing to elevate privileges.1

created 2020-08-24MALWAREcarried by 1 group

KONNIS0356 ↗

Has used parent PID spoofing to spawn a new cmd process using CreateProcessW and a handle to Taskmgr.exe.1

created 2019-01-31MALWARE

Cobalt StrikeS0154 ↗

Can spawn processes with alternate PPIDs.1 2

created 2017-12-14MALWAREcarried by 30 groups

All 4 software entries for this technique

Offense vs defense T1134.004

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 1Splunk ESCU (cumulative) · 2

first rule: 2021 Q4

Parent PID Spoofing detection strategy DET0489

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Behavior-chain detection for T1134.004 Access Token Manipulation: Parent PID Spoofing (Windows)

Enterprise

1 platform

AN1351 · Windows

A process explicitly forges its parent using EXTENDED_STARTUPINFO + PROC_THREAD_ATTRIBUTE_PARENT_PROCESS (UpdateProcThreadAttribute → CreateProcess[A/W]/CreateProcessAsUserW) or other Native API paths, resulting in **mismatched/implausible lineage** across ETW EventHeader ProcessId, Security 4688 Creator Process ID/Name, and sysmon ParentProcessGuid. Often paired with privilege escalation when the chosen parent runs as SYSTEM.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
OS API ExecutionDC0021	etw:Microsoft-Windows-Kernel-Process	api_call: UpdateProcThreadAttribute (PROC_THREAD_ATTRIBUTE_PARENT_PROCESS) and CreateProcess* with EXTENDED_STARTUPINFO_PRESENT / StartupInfoEx
Process CreationDC0032	WinEventLog:Security	EventCode=4688
Process MetadataDC0034	etw:Microsoft-Windows-Kernel-Process	process_start: EventHeader.ProcessId true parent vs reported PPID mismatch

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Correlation window between UpdateProcThreadAttribute/CreateProcess* and the resulting process (default 5–10 minutes).
AllowedSpoofers	Legitimate binaries that commonly use StartupInfoEx/PPID assignment (e.g., consent.exe, svchost.exe during UAC).
ParentPrivilegeDeltaThreshold	Minimum privilege/integrity gap between chosen parent and real caller to raise severity.
LineageMismatchTolerance	Number of mismatched sources (0–3) before alerting to reduce noise.
SensitiveParents	List of SYSTEM parents that, if spoofed, auto‑escalate severity (e.g., lsass.exe, services.exe, wininit.exe).

Tests5ExecutorsPowerShell 5Need elevation0 of 5Have prerequisites5Have cleanup1Platformswindows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Parent PID Spoofing using PowerShell

windows

PowerShell

—

Yes

This test uses PowerShell to replicates how Cobalt Strike does ppid spoofing and masquerade a spawned process. Upon execution, "Process C:\Program Files\Internet Explorer\iexplore.exe is spawned with pid ####" will be displayed and calc.exe will be launched. Credit to In Ming Loh (https://github.com/countercept/ppid-spoofing/blob/master/PPID-Spoof.ps1)

Input arguments

Name	Type	Default	Description
dll_path	path	PathToAtomicsFolder\T1134.004\bin\calc.dll	Path of the dll to inject
dll_process_name	string	calculator	Name of the created process from the injected dll
parent_process_name	string	explorer	Name of the parent process
spawnto_process_name	string	iexplore	Name of the process to spawn
spawnto_process_path	path	C:\Program Files\Internet Explorer\iexplore.exe	Path of the process to spawn

Attack command

. "$PathToAtomicsFolder\T1134.004\src\PPID-Spoof.ps1"
$ppid=Get-Process #{parent_process_name} | select -expand id
PPID-Spoof -ppid $ppid -spawnto "#{spawnto_process_path}" -dllpath "#{dll_path}"

Cleanup command

Stop-Process -Name "#{dll_process_name}" -ErrorAction Ignore
Stop-Process -Name "#{spawnto_process_name}" -ErrorAction Ignore

Prerequisite

DLL to inject must exist on disk at specified location (#{dll_path})

Check

if (Test-Path "#{dll_path}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "#{dll_path}") -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1134.004/bin/calc.dll" -OutFile "#{dll_path}"

Prerequisite

PPID.ps1 must exist on disk at $PathToAtomicsFolder\T1134.004\src\PPID-Spoof.ps1

Check

if (Test-Path "$PathToAtomicsFolder\T1134.004\src\PPID-Spoof.ps1") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "$PathToAtomicsFolder\T1134.004\src\PPID-Spoof.ps1") -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1134.004/src/PPID-Spoof.ps1" -OutFile "$PathToAtomicsFolder\T1134.004\src\PPID-Spoof.ps1"

GUIDadc4add8-d2fc-4aa3-9d29-8b6e1aa7d5e8

Parent PID Spoofing - Spawn from Current Process

windows

PowerShell

—

Spawns a powershell.exe process as a child of the current process.

Input arguments

Name	Type	Default	Description
file_path	path	$Env:windir\System32\WindowsPowerShell\v1.0\powershell.exe	File path or name of process to spawn
parent_pid	string	$PID	PID of process to spawn from
command_line	string	-Command Start-Sleep 10	Specified command line to use

Attack command

Start-ATHProcessUnderSpecificParent -FilePath #{file_path} -CommandLine '#{command_line}' -ParentId #{parent_pid}

Prerequisite

The AtomicTestHarnesses module must be installed and Start-ATHProcessUnderSpecificParent must be exported in the module.

Check

$RequiredModule = Get-Module -Name AtomicTestHarnesses -ListAvailable
if (-not $RequiredModule) {exit 1}
if (-not $RequiredModule.ExportedCommands['Start-ATHProcessUnderSpecificParent']) {exit 1} else {exit 0}

Satisfy

Install-Module -Name AtomicTestHarnesses -Scope CurrentUser -Force

GUID56c8e67b-b4ce-4641-b644-4e4383b7381e

Parent PID Spoofing - Spawn from Specified Process

windows

PowerShell

—

Spawns a notepad.exe process as a child of the current process.

Input arguments

Name	Type	Default	Description
test_guid	string	12345678-1234-1234-1234-123456789123	Defined test GUID
parent_pid	string	$PID	PID of process to spawn from

Attack command

Start-ATHProcessUnderSpecificParent  -ParentId #{parent_pid} -TestGuid #{test_guid}

Prerequisite

The AtomicTestHarnesses module must be installed and Start-ATHProcessUnderSpecificParent must be exported in the module.

Check

$RequiredModule = Get-Module -Name AtomicTestHarnesses -ListAvailable
if (-not $RequiredModule) {exit 1}
if (-not $RequiredModule.ExportedCommands['Start-ATHProcessUnderSpecificParent']) {exit 1} else {exit 0}

Satisfy

Install-Module -Name AtomicTestHarnesses -Scope CurrentUser -Force

GUIDe32d1ab9-1436-4932-91cf-939b9aed1b19

Parent PID Spoofing - Spawn from svchost.exe

windows

PowerShell

—

Spawnd a process as a child of the first accessible svchost.exe process.

Input arguments

Name	Type	Default	Description
file_path	path	$Env:windir\System32\WindowsPowerShell\v1.0\powershell.exe	File path or name of process to spawn
command_line	string	-Command Start-Sleep 10	Specified command line to use

Attack command

Get-CimInstance -ClassName Win32_Process -Property Name, CommandLine, ProcessId -Filter "Name = 'svchost.exe' AND CommandLine LIKE '%'" | Select-Object -First 1 | Start-ATHProcessUnderSpecificParent -FilePath #{file_path} -CommandLine '#{command_line}'

Prerequisite

The AtomicTestHarnesses module must be installed and Start-ATHProcessUnderSpecificParent must be exported in the module.

Check

$RequiredModule = Get-Module -Name AtomicTestHarnesses -ListAvailable
if (-not $RequiredModule) {exit 1}
if (-not $RequiredModule.ExportedCommands['Start-ATHProcessUnderSpecificParent']) {exit 1} else {exit 0}

Satisfy

Install-Module -Name AtomicTestHarnesses -Scope CurrentUser -Force

GUID891cf747-0179-4ba1-af5b-71b33fbea3db

Parent PID Spoofing - Spawn from New Process

windows

PowerShell

—

Creates a notepad.exe process and then spawns a powershell.exe process as a child of it.

Input arguments

Name	Type	Default	Description
file_path	path	$Env:windir\System32\WindowsPowerShell\v1.0\powershell.exe	File path or name of process to spawn
parent_name	path	$Env:windir\System32\notepad.exe	Parent process to spoof from
command_line	string	-Command Start-Sleep 10	Specified command line to use

Attack command

Start-Process -FilePath #{parent_name} -PassThru | Start-ATHProcessUnderSpecificParent -FilePath #{file_path} -CommandLine '#{command_line}'

Prerequisite

The AtomicTestHarnesses module must be installed and Start-ATHProcessUnderSpecificParent must be exported in the module.

Check

$RequiredModule = Get-Module -Name AtomicTestHarnesses -ListAvailable
if (-not $RequiredModule) {exit 1}
if (-not $RequiredModule.ExportedCommands['Start-ATHProcessUnderSpecificParent']) {exit 1} else {exit 0}

Satisfy

Install-Module -Name AtomicTestHarnesses -Scope CurrentUser -Force

GUIDcb1b01d4-caf5-4ed6-a999-69fa7816146b

Tests from Atomic Red Team (MIT licence) · technique definition

Parent PID Spoofing detections T1134.004

3 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

54th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs