An adversary may attempt to evade process tree-based analysis by modifying executed malware's parent process ID (PPID). If endpoint protection software leverages the “parent-child" relationship for detection, breaking this relationship could result in the adversary’s behavior not being associated…
Sub-technique of Masquerading (T1036).
Sigma detection rules (2)
T1036.009 Masquerading: Break Process Trees
title: "T1036.009 Masquerading: Break Process Trees"
id: efa20d90-8302-4e52-9eb5-ef9f0a5ebae8
description: 'Stage-1 signal for Masquerading via Breaking Process Trees: setsid/clone syscalls executed from /tmp or /dev/shm. A single setsid/clone call does not confirm the double-fork-then-reparent-to-init pattern the technique describes, so this rule is paired with a companion confirmation rule (orphan process reparented to PID 1) and a temporal_ordered correlation requiring both to fire for the same executable within 30 seconds before alerting at high severity. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: TimeWindow, ReparentingDetectionScope, ExecutableScope.'
references:
- https://attack.mitre.org/techniques/T1036/009
author: Shahrukh Khan
date: 2026-02-04
license: MIT
tags:
- attack.stealth
- attack.t1036.009
logsource:
category: process_creation
product: linux
detection:
selection:
type: SYSCALL
syscall:
- setsid
- clone
exe|contains:
- '/tmp/'
- '/dev/shm/'
condition: selection
falsepositives:
- Legitimate daemonization by services and long-running background jobs also calls setsid/clone to detach from their controlling terminal; this is only the first-stage signal, standing alone it is low-fidelity - see the companion correlation rule for the confirmed (higher-severity) variant.
level: low
---
title: "T1036.009 Masquerading: Break Process Trees - Orphan Reparented to Init"
id: 6c2f1a4b-9d3e-4a7c-8b1f-5e6a2d9c7f13
description: 'Confirmation signal for efa20d90-8302-4e52-9eb5-ef9f0a5ebae8: a process running from /tmp or /dev/shm whose parent process ID is 1 (adopted by init), consistent with the double-fork detach-and-reparent pattern used to break process-tree lineage.'
references:
- https://attack.mitre.org/techniques/T1036/009
author: Shahrukh Khan
date: 2026-02-04
license: MIT
tags:
- attack.stealth
- attack.t1036.009
logsource:
category: process_creation
product: linux
detection:
selection:
type: SYSCALL
ppid: 1
exe|contains:
- '/tmp/'
- '/dev/shm/'
condition: selection
falsepositives:
- Legitimate short-lived helper daemons and process supervisors that intentionally double-fork and detach also get adopted by init; this rule is intended only as the second half of the paired correlation, not for standalone alerting.
level: low
---
title: "T1036.009 Masquerading: Break Process Trees - Confirmed Double-Fork Reparenting"
id: 8a1e5f3c-2b7d-4c9a-a6e1-3f8b0d5c9e42
description: 'Correlation companion for efa20d90-8302-4e52-9eb5-ef9f0a5ebae8: requires the setsid/clone signal followed by the orphan-adopted-by-init confirmation (6c2f1a4b-9d3e-4a7c-8b1f-5e6a2d9c7f13) for the same executable within a 30-second window, approximating the double-fork-then-reparent-to-PID1 process-tree-breaking pattern.'
status: experimental
correlation:
type: temporal_ordered
rules:
- efa20d90-8302-4e52-9eb5-ef9f0a5ebae8
- 6c2f1a4b-9d3e-4a7c-8b1f-5e6a2d9c7f13
group-by:
- exe
timespan: 30s
condition: "efa20d90-8302-4e52-9eb5-ef9f0a5ebae8 and 6c2f1a4b-9d3e-4a7c-8b1f-5e6a2d9c7f13"
level: high
T1036.009 Masquerading: Break Process Trees
title: "T1036.009 Masquerading: Break Process Trees"
id: d6e9d512-08d9-40f9-b150-6b75a0f892bc
description: 'Detection Strategy for Masquerading via Breaking Process Trees. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: AnomalyParentPID, AllowedServices, ProcessNameEntropy.'
references:
- https://attack.mitre.org/techniques/T1036/009
author: Shahrukh Khan
date: 2026-02-14
license: MIT
tags:
- attack.stealth
- attack.t1036.009
logsource:
category: process_creation
product: macos
detection:
selection:
ParentImage: '/sbin/launchd'
selection_random:
Image|re: '.*/[a-z0-9]{12,}