Privileges Elevation via Parent Process PID Spoofing

  1[metadata]
  2creation_date = "2022/10/20"
  3integration = ["endpoint"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies parent process spoofing used to create an elevated child process. Adversaries may spoof the parent process
 11identifier (PPID) of a new process to evade process-monitoring defenses or to elevate privileges.
 12"""
 13from = "now-9m"
 14index = ["logs-endpoint.events.process-*"]
 15language = "eql"
 16license = "Elastic License v2"
 17name = "Privileges Elevation via Parent Process PID Spoofing"
 18references = [
 19    "https://gist.github.com/xpn/a057a26ec81e736518ee50848b9c2cd6",
 20    "https://blog.didierstevens.com/2017/03/20/that-is-not-my-child-process/",
 21    "https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-updateprocthreadattribute",
 22    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1134.002/T1134.002.md",
 23]
 24risk_score = 73
 25rule_id = "26b01043-4f04-4d2f-882a-5a1d2e95751b"
 26severity = "high"
 27tags = [
 28    "Domain: Endpoint",
 29    "OS: Windows",
 30    "Use Case: Threat Detection",
 31    "Tactic: Privilege Escalation",
 32    "Data Source: Elastic Defend",
 33    "Resources: Investigation Guide",
 34    "Noise: High",
 35    "Performance: Normal",
 36    "Profile: Aggressive",
 37    "Rule Type: Event Correlation (EQL)",
 38    "Platform: Windows",
 39]
 40timestamp_override = "event.ingested"
 41type = "eql"
 42
 43query = '''
 44/* This rule is compatible with Elastic Endpoint only */
 45
 46process where host.os.type == "windows" and event.action == "start" and
 47
 48 /* process creation via seclogon */
 49 process.parent.Ext.real.pid > 0 and process.parent.executable != null and
 50
 51 /* PrivEsc to SYSTEM */
 52 user.id : "S-1-5-18"  and
 53
 54 /* Common FPs - evasion via hollowing is possible, should be covered by code injection */
 55 not process.executable : ("?:\\Windows\\System32\\WerFault.exe",
 56                           "?:\\Windows\\SysWOW64\\WerFault.exe",
 57                           "?:\\Windows\\System32\\WerFaultSecure.exe",
 58                           "?:\\Windows\\SysWOW64\\WerFaultSecure.exe",
 59                           "?:\\Windows\\System32\\Wermgr.exe",
 60                           "?:\\Windows\\SysWOW64\\Wermgr.exe",
 61                           "?:\\Windows\\SoftwareDistribution\\Download\\Install\\securityhealthsetup.exe") and
 62 /* Logon Utilities */
 63 not (process.parent.executable : "?:\\Windows\\System32\\Utilman.exe" and
 64     process.executable : ("?:\\Windows\\System32\\osk.exe",
 65                           "?:\\Windows\\System32\\Narrator.exe",
 66                           "?:\\Windows\\System32\\Magnify.exe",
 67                           "?:\\Windows\\System32\\VoiceAccess.exe")) and
 68
 69 not process.parent.executable : "?:\\Windows\\System32\\AtBroker.exe" and
 70
 71 not (process.code_signature.subject_name in
 72           ("philandro Software GmbH", "Freedom Scientific Inc.", "TeamViewer Germany GmbH", "Projector.is, Inc.",
 73            "TeamViewer GmbH", "Cisco WebEx LLC", "Dell Inc") and process.code_signature.trusted == true) and
 74
 75 /* AM_Delta_Patch Windows Update */
 76 not (process.executable : ("?:\\Windows\\System32\\MpSigStub.exe", "?:\\Windows\\SysWOW64\\MpSigStub.exe") and
 77      process.parent.executable : ("?:\\Windows\\System32\\wuauclt.exe",
 78                                   "?:\\Windows\\SysWOW64\\wuauclt.exe",
 79                                   "?:\\Windows\\UUS\\Packages\\Preview\\*\\wuaucltcore.exe",
 80                                   "?:\\Windows\\UUS\\amd64\\wuauclt.exe",
 81                                   "?:\\Windows\\UUS\\amd64\\wuaucltcore.exe",
 82                                   "?:\\ProgramData\\Microsoft\\Windows\\UUS\\*\\wuaucltcore.exe")) and
 83
 84 /* Other third party SW */
 85 not process.parent.executable :
 86                   ("?:\\Program Files (x86)\\HEAT Software\\HEAT Remote\\HEATRemoteServer.exe",
 87                    "?:\\Program Files (x86)\\VisualCron\\VisualCronService.exe",
 88                    "?:\\Program Files\\BinaryDefense\\Vision\\Agent\\bds-vision-agent-app.exe",
 89                    "?:\\Program Files\\Tablet\\Wacom\\WacomHost.exe",
 90                    "?:\\Program Files (x86)\\LogMeIn\\x64\\LogMeIn.exe",
 91                    "?:\\Program Files (x86)\\EMC Captiva\\Captiva Cloud Runtime\\Emc.Captiva.WebCaptureRunner.exe",
 92                    "?:\\Program Files\\Freedom Scientific\\*.exe",
 93                    "?:\\Program Files (x86)\\Google\\Chrome Remote Desktop\\*\\remoting_host.exe",
 94                    "?:\\Program Files (x86)\\GoToAssist Remote Support Customer\\*\\g2ax_comm_customer.exe") and
 95 not (
 96    process.code_signature.trusted == true and process.code_signature.subject_name == "Netwrix Corporation" and
 97    process.name : ("adcrcpy.exe", "addumpcaller.exe") and process.parent.name : (
 98      "Netwrix.ADA.EventCollector.exe",
 99      "Netwrix.ADA.Analyzer.exe"
100    )
101 )
102'''
103
104note = """## Triage and analysis
105
106### Investigating Privileges Elevation via Parent Process PID Spoofing
107
108#### Possible investigation steps
109
110- Does the alert show a SYSTEM child with a spoofed parent relationship?
111  - Focus: `user.id`, token integrity, `process.parent.pid`, `process.parent.Ext.real.pid`, and `process.parent.executable`.
112  - Implication: escalate when a SYSTEM child has a nonzero real-creator PID that differs from the reported parent, especially when that parent gives trusted system, service, or desktop cover; treat a recognized broker or authorized test as only a candidate benign path until creator and child intent are checked.
113  - Why: PPID spoofing can make process-tree views show the selected parent instead of the process that requested creation.
114- Which process actually requested the spoofed launch?
115  - Focus: recovered creator for `process.parent.Ext.real.pid`: `process.entity_id`, `process.executable`, `process.command_line`, signer, and trust state.
116  - Implication: escalate when the creator is unsigned, user-writable, a shell or script launcher, or unrelated to the reported parent; lower suspicion only for a stable signed vendor, update, accessibility, audit, or test component tied to the same workflow.
117  - Why: the Windows parent-process attribute can select a parent handle, so the recovered creator is the actor path the visible parent may hide.
118  - Hint: search the same `host.id` around `@timestamp` for `process.pid` = `process.parent.Ext.real.pid`; keep PID windows tight because PIDs are reused. $investigate_0
119- Does the SYSTEM child identity and command line fit the recovered creator workflow?
120  - Focus: `process.executable`, `process.command_line`, `process.pe.original_file_name`, signer, and trust state.
121  - Implication: escalate when the child is a shell, script host, renamed binary, user-writable executable, unsigned or untrusted, or has commands that do not belong to the recovered creator; trusted signing reduces identity concern but does not clear PPID spoofing without launch-context fit.
122- Did the spoofed SYSTEM child launch follow-on activity?
123  - Focus: child process events from `process.entity_id`, reviewing `process.executable`, `process.command_line`, and `user.id`. $investigate_1
124  - Implication: escalate when it spawns shells, scripting, credential, service, or lateral-movement tooling under SYSTEM; no descendants lowers immediate impact but does not clear a suspicious creator or child identity.
125  - Hint: if `process.entity_id` is unavailable, fall back to `host.id`, `process.pid`, and a tight alert-time window.
126- If escalation is likely, what is the immediate scope?
127  - Focus: prior process alerts for `host.id` and `user.id` with matching child executable or hash, reported parent, and real-creator PID.
128    - $investigate_2
129    - $investigate_3
130  - Implication: expand containment and scoping when the same child or creator appears on other hosts or unrelated users; keep scope local when the tuple is isolated and no descendant activity contradicts it. Do not use recurrence alone to close.
131  - Range: use a lookback that fits endpoint retention.
132
133Disposition: escalate when PPID spoofing to SYSTEM has an unrecognized creator, suspicious child, misleading parent, SYSTEM follow-on activity, or cross-host scope. Close only when alert and recovered telemetry tie the event to one exact recognized broker or authorized test and no descendant evidence contradicts it; preserve evidence and escalate when recovery is incomplete or evidence conflicts.
134
135### False positive analysis
136
137- Signed broker cases require the exact telemetry tuple: child path, signer, and command; reported parent path; recovered creator path, signer, and command; and host/user cohort. Authorized PPID-spoofing tests require exact host, time, tester, test binary, parent PID, real creator PID, and child command line. Without that tie to one product or test, treat as suspicious because the rule already filters common Windows Error Reporting, update, accessibility, remote-support, and Netwrix patterns.
138- Build exceptions only from the minimum confirmed tuple: `process.hash.sha256` or `process.code_signature.thumbprint_sha256`, `process.executable`, `process.parent.executable`, recovered creator identity, `host.id` or managed host group, and the test or product command pattern. Avoid exceptions on `process.name`, `process.parent.name`, or signer alone.
139
140### Response and remediation
141
142- If confirmed benign: document the exact child, reported parent, real creator, signer, command line, host, and user evidence that proved the workflow; reverse any temporary containment and create only a narrow exception for the same tuple.
143- If suspicious but unconfirmed: preserve the alert, process event, recovered creator and descendant process records, process entity IDs and PIDs, command lines, hashes, signers, and current process state before containment. Use reversible containment such as host isolation or temporary policy controls based on host criticality; avoid killing the child or creator until evidence is preserved.
144- If confirmed malicious: isolate the affected host when identity, lineage, or descendant evidence shows unauthorized SYSTEM execution. Before termination, record `process.entity_id`, `process.parent.Ext.real.pid`, `process.command_line`, and `process.hash.sha256`; then terminate malicious child or descendant processes and remove only the binaries, scripts, services, or persistence found during follow-on investigation.
145- Reset or rotate credentials only for accounts, services, or remote-access paths whose misuse is confirmed by additional evidence. Do not treat SYSTEM context alone as proof that a named user credential was compromised.
146- Post-incident hardening: restrict administrative paths that can obtain parent-process creation privileges, review who can run PPID-spoofing test tools, and document the confirmed tuple or malicious artifact set so future analysts can separate repeated product behavior from repeated abuse."""
147
148setup = """## Setup
149
150This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
151
152Setup instructions: https://ela.st/install-elastic-defend
153"""
154
155[rule.investigation_fields]
156field_names = [
157    "@timestamp",
158    "host.id",
159    "user.id",
160    "process.entity_id",
161    "process.pid",
162    "process.executable",
163    "process.command_line",
164    "process.Ext.token.integrity_level_name",
165    "process.Ext.token.elevation_level",
166    "process.parent.pid",
167    "process.parent.Ext.real.pid",
168    "process.parent.executable",
169    "process.hash.sha256",
170    "process.code_signature.trusted",
171    "process.code_signature.subject_name",
172]
173
174[transform]
175
176[[transform.investigate]]
177label = "Real creator process event"
178description = ""
179providers = [
180  [
181    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" },
182    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
183    { excluded = false, field = "process.pid", queryType = "phrase", value = "{{process.parent.Ext.real.pid}}", valueType = "string" }
184  ]
185]
186relativeFrom = "now-15m"
187relativeTo = "now"
188
189[[transform.investigate]]
190label = "Descendant process events for the spoofed child"
191description = ""
192providers = [
193  [
194    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" },
195    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
196    { excluded = false, field = "process.parent.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" }
197  ]
198]
199relativeFrom = "now-1h"
200relativeTo = "now"
201
202[[transform.investigate]]
203label = "Alerts associated with the host"
204description = ""
205providers = [
206  [
207    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
208    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" }
209  ]
210]
211relativeFrom = "now-48h/h"
212relativeTo = "now"
213
214[[transform.investigate]]
215label = "Alerts associated with the user"
216description = ""
217providers = [
218  [
219    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
220    { excluded = false, field = "user.id", queryType = "phrase", value = "{{user.id}}", valueType = "string" }
221  ]
222]
223relativeFrom = "now-48h/h"
224relativeTo = "now"
225
226[[rule.threat]]
227framework = "MITRE ATT&CK"
228
229[[rule.threat.technique]]
230id = "T1134"
231name = "Access Token Manipulation"
232reference = "https://attack.mitre.org/techniques/T1134/"
233
234[[rule.threat.technique.subtechnique]]
235id = "T1134.002"
236name = "Create Process with Token"
237reference = "https://attack.mitre.org/techniques/T1134/002/"
238
239[[rule.threat.technique.subtechnique]]
240id = "T1134.004"
241name = "Parent PID Spoofing"
242reference = "https://attack.mitre.org/techniques/T1134/004/"
243
244[rule.threat.tactic]
245id = "TA0004"
246name = "Privilege Escalation"
247reference = "https://attack.mitre.org/tactics/TA0004/"