Adversaries may spoof the parent process identifier (PPID) of a new process to evade process-monitoring defenses or to elevate privileges. New processes are typically spawned directly from their parent, or calling, process unless explicitly specified. One way of explicitly assigning the PPID of a new process is via theCreateProcess API call, which supports a parameter that defines the PPID to use.^[1] This functionality is used by Windows features such as User Account Control (UAC) to correctly set the PPID after a requested elevated process is spawned by SYSTEM (typically viasvchost.exe orconsent.exe) rather than the current user context.^[2]

Adversaries may abuse these mechanisms to evade defenses, such as those blocking processes spawning directly from Office documents, and analysis targeting unusual/potentially malicious parent-child process relationships, such as spoofing the PPID ofPowerShell/Rundll32 to beexplorer.exe rather than an Office document delivered as part ofSpearphishing Attachment.^[3] This spoofing could be executed viaVisual Basic within a malicious Office document or any code that can performNative API.^[4][3]

Explicitly assigning the PPID may also enable elevated privileges given appropriate access rights to the parent process. For example, an adversary in a privileged user context (i.e. administrator) may spawn a new process and assign the parent as a process running as SYSTEM (such aslsass.exe), causing the new process to be elevated via the inherited access token.^[5]