T1134.004 — Parent PID Spoofing

Tactics: Stealth, Privilege Escalation · Platforms: Windows

Adversaries may spoof the parent process identifier (PPID) of a new process to evade process-monitoring defenses or to elevate privileges. New processes are typically spawned directly from their parent, or calling, process unless explicitly specified. One way of explicitly assigning the PPID of a…

Sub-technique of Access Token Manipulation (T1134).

Sigma detection rules (1)

T1134.004 Access Token Manipulation: Parent PID Spoofing

title: "T1134.004 Access Token Manipulation: Parent PID Spoofing"
id: e9eb9b40-e25e-42a5-ae55-dc6ef61e1465
description: 'Detects process creation events with an unresolvable parent process (empty ParentImage despite a non-zero ParentProcessId), the closest single-event Sysmon proxy for PPID spoofing. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: TimeWindow, AllowedSpoofers, ParentPrivilegeDeltaThreshold, LineageMismatchTolerance, SensitiveParents.'
references:
  - https://attack.mitre.org/techniques/T1134/004
author: Shahrukh Khan
date: 2026-04-21
license: MIT
tags:
  - attack.stealth
  - attack.privilege-escalation
  - attack.t1134.004

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection:
    EventID: 1
  selection_unresolved_parent:
    ParentImage:
      - ''
      - '-'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and selection_unresolved_parent and not filter_system_account

falsepositives:
  - Rare race conditions where the true parent process exits immediately after spawning the child, before Sysmon resolves ParentImage.

level: medium

Related sub-techniques

Explore