Detecting Parent PID Spoofing: Creator Mismatch and Handle Access

A caller can name any process it holds a handle to as the parent of a new one by passing PROC_THREAD_ATTRIBUTE_PARENT_PROCESS to UpdateProcThreadAttribute before CreateProcess. The child then appears under explorer.exe or a service host instead of under the real launcher, defeating parent-child rules. The forgery is complete at the field level but not at the event level.

Signals at a Glance

Finding the Real Creator

Sysmon Event 1 and Security Event 4688 report the parent as recorded in the new process, which is exactly the field the attacker controls. The Microsoft-Windows-Kernel-Process ETW provider is different: its process-start event is stamped with the real creating process in the event header, alongside the recorded parent ID. When the two differ, the parent was spoofed. Several EDRs surface this directly; if yours does, a KQL-style check looks like this:

// KQL over an EDR table exposing both the real creator and the reported parent
// (field names vary by product; map them to your schema)
ProcessCreateEvents
| where RealCreatorPid != ReportedParentPid
| where not(RealCreatorImage has_any ("\\svchost.exe", "\\services.exe", "\\WmiPrvSE.exe"))
| project Timestamp, DeviceName, RealCreatorImage, ReportedParentImage,
          ChildImage, ChildCommandLine
| order by Timestamp desc
// tune/validate: shell extensions, UAC elevation and some launchers legitimately differ.

If you do not have creator-versus-parent data, move one step earlier. To spoof a parent, the caller must hold a handle to it with the create-process right. Sysmon Event 10 records that handle request:

title: Process Handle Opened with PROCESS_CREATE_PROCESS
logsource:
  product: windows
  category: process_access
detection:
  selection:
    GrantedAccess|endswith:
      - '0x0080'
      - '0x1fffff'
    TargetImage|endswith:
      - '\explorer.exe'
      - '\svchost.exe'
      - '\winlogon.exe'
  filter_system:
    SourceImage|startswith:
      - 'C:\Windows\System32\'
      - 'C:\Program Files\'
  condition: selection and not filter_system
level: medium
# tune/validate: expect launchers, elevation helpers and EDR agents.

Contextual Checks

• Compare the child’s integrity level and session with the claimed parent; a spoofed child often inherits properties from the real caller instead.
• Flag children of explorer.exe or svchost.exe that are command-line tools launched with no user interaction, such as cmd.exe with a long encoded argument.
• Hunt unsigned binaries that open a handle to a high-value process and spawn a child within a second.
• Never allowlist a parent-child pair globally; allowlist the pair together with the signing and path of the child.