Which SIEM platforms have a T1134.004 detection rule?

df00tech provides T1134.004 (Parent PID Spoofing) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect Parent PID Spoofing (T1134.004)?

Detecting Parent PID Spoofing requires the following data sources: Process: Process Creation, Microsoft Defender for Endpoint, Process: OS API Execution.

What severity and confidence is the T1134.004 detection?

The T1134.004 detection is rated high severity with high confidence.

What are common false positives for T1134.004?

Common false positives for T1134.004 include: UAC elevation mediated by consent.exe may briefly show svchost.exe as a parent during token reassignment in certain Windows versions before the handoff completes; Enterprise EDR or AV agents that use indirect process spawning for self-protection modules may appear with unexpected parent process assignments in telemetry; Windows Remote Management (WinRM) and PowerShell remoting sessions may produce unusual parent-child relationships when executing cmdlets via the wsmprovhost.exe service host.

T1134.004 Google Chronicle · YARA-L

Detect Parent PID Spoofing in Google Chronicle

Adversaries may spoof the parent process identifier (PPID) of a new process to evade process-monitoring defenses or to elevate privileges. By calling CreateProcess with a PROC_THREAD_ATTRIBUTE_PARENT_PROCESS entry in the process attribute list, an attacker can assign any running process as the apparent parent of the newly spawned child. Security tools that rely on parent-child process lineage for detection see only the spoofed parent, masking the true origin. This technique is also exploited for privilege escalation: by opening a handle to a SYSTEM-level process such as lsass.exe and using it as the spoofed parent, the child process inherits the SYSTEM access token. Used in the wild by Cobalt Strike, KONNI, PipeMon, and DarkGate.

MITRE ATT&CK

Tactic: Defense Evasion Privilege Escalation
Technique: T1134 Access Token Manipulation
Sub-technique: T1134.004 Parent PID Spoofing
Canonical reference: https://attack.mitre.org/techniques/T1134/004/

YARA-L Detection Query

Google Chronicle (YARA-L)

yaral

rule t1134_004_parent_pid_spoofing {
  meta:
    author = "df00tech"
    description = "Detects Parent PID Spoofing (T1134.004) via three branches: high-privilege system processes appearing to spawn LOLBins/shells (impossible without PPID spoofing), SYSTEM-integrity children parented by lower-integrity processes, and explorer.exe parenting SYSTEM-integrity processes."
    mitre_attack_tactic = "Privilege Escalation, Defense Evasion"
    mitre_attack_technique = "T1134.004"
    severity = "HIGH"
    priority = "HIGH"
    reference = "https://attack.mitre.org/techniques/T1134/004/"
    version = "1.0"
    created = "2026-04-18"

  events:
    $proc.metadata.event_type = "PROCESS_LAUNCH"
    $proc.principal.hostname = $hostname

    // Normalize parent and child process names
    re.capture($proc.target.process.file.full_path, `[^\\]+$`) = $child_name
    re.capture($proc.principal.process.file.full_path, `[^\\]+$`) = $parent_name

    // Branch 1: High-privilege system parent spawning suspicious child
    // Branch 2: SYSTEM child from non-SYSTEM parent  
    // Branch 3: explorer.exe parenting SYSTEM process
    (
      (
        re.regex($parent_name, `(?i)^(lsass|wininit|smss|csrss|winlogon|services)\.exe$`) and
        re.regex($child_name, `(?i)^(cmd|powershell|pwsh|rundll32|regsvr32|mshta|wscript|cscript|msbuild|certutil|bitsadmin|cmstp|installutil)\.exe$`)
      ) or
      (
        $proc.target.process.integrity_level_rid = 16384 and  // SYSTEM integrity
        not re.regex($parent_name, `(?i)^(lsass|wininit|smss|csrss|winlogon|services|system|ntoskrnl)\.exe$`) and
        re.regex($child_name, `(?i)^(cmd|powershell|pwsh|rundll32|regsvr32|mshta|wscript|cscript|msbuild|certutil|bitsadmin|cmstp|installutil)\.exe$`)
      ) or
      (
        re.regex($parent_name, `(?i)^explorer\.exe$`) and
        $proc.target.process.integrity_level_rid = 16384  // SYSTEM integrity
      )
    )

  condition:
    $proc
}

high severity medium confidence

Chronicle YARA-L 2.0 rule detecting Parent PID Spoofing (T1134.004) using UDM process launch events. Three detection branches evaluate: (1) protected Windows system processes (lsass, wininit, smss, csrss, winlogon, services) appearing as parents of LOLBins or interactive shells, which is impossible without PROC_THREAD_ATTRIBUTE_PARENT_PROCESS abuse; (2) processes with SYSTEM integrity level (integrity_level_rid = 16384) parented by non-system processes, indicating SYSTEM token inheritance through a spoofed parent handle; (3) explorer.exe parenting any SYSTEM-integrity process, which cannot occur in normal Windows operation. Targets Cobalt Strike, KONNI, PipeMon, and DarkGate post-exploitation activity.

Data Sources

Google Chronicle UDMWindows Sysmon via Chronicle ForwarderMicrosoft Defender for Endpoint via Chronicle

Required Tables

PROCESS_LAUNCH UDM events

False Positives & Tuning

Security orchestration tools and SOAR platforms that create processes with specific parent handles for forensic artifact collection or triage automation may trigger Branch 1 or Branch 2 detections
Windows Task Scheduler running tasks under SYSTEM context where the initiating user-mode trigger process appears in telemetry as the parent can create apparent integrity mismatches in Chronicle UDM normalized data
Custom LOB application launchers that use Windows job objects or explicit parent process attributes for process group management may generate unusual parent-child relationships resembling PPID spoofing

Download portable Sigma rule (.yml)

Other platforms for T1134.004

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1PPID Spoofing via PowerShell P/Invoke — Explorer Parent
Expected signal: Sysmon Event ID 1: cmd.exe process creation with ParentImage=<path>\explorer.exe and ParentProcessId matching the selected explorer.exe PID. The actual spawning process (PowerShell) does NOT appear as ParentImage. Sysmon Event ID 10: may capture OpenProcess against explorer.exe from PowerShell with GrantedAccess=0x0080. Security Event ID 4688 (if audit enabled): CreatorProcessId=PowerShell's PID, ParentProcessId=explorer.exe's PID — the mismatch confirms spoofing.
Test 2PPID Spoofing for Privilege Escalation — LSASS as Spoofed Parent
Expected signal: Sysmon Event ID 1: cmd.exe with ParentImage=lsass.exe, ParentProcessId=LSASS PID, IntegrityLevel=System. Sysmon Event ID 10: SourceImage=PowerShell accessing TargetImage=lsass.exe with GrantedAccess=0x0080. Security Event ID 4672: Special privilege logon for the SYSTEM session inherited by cmd.exe. Security Event ID 4688 (if audit enabled): CreatorProcessId=PowerShell PID vs ParentProcessId=LSASS PID — mismatch is the definitive forensic artifact.
Test 3Cobalt Strike Spawn-To Simulation — Rundll32 Under Explorer
Expected signal: Sysmon Event ID 1: rundll32.exe creation with ParentImage=explorer.exe and ParentProcessId matching the selected explorer.exe PID. Sysmon Event ID 10: OpenProcess from PowerShell against explorer.exe with GrantedAccess=0x0080. The rundll32.exe -> explorer.exe parent relationship is the canonical Cobalt Strike PPID spoofing telemetry signature seen in real incident response engagements.
Test 4PPID Spoofing Detection Validation — Sysmon ParentProcessId vs Security 4688 CreatorProcessId
Expected signal: Sysmon Event ID 1: cmd.exe with ParentImage=svchost.exe, ParentProcessId=<svchost PID>. Security Event ID 4688 (requires audit process creation + command line enabled): CreatorProcessId=<PowerShell PID>, ParentProcessId=<svchost PID> — the mismatch between Creator and Parent is the definitive PPID spoof indicator. The test outputs exact PID values needed for manual SIEM correlation to confirm the discrepancy is visible in your environment.

Last updated: 2026-04-18 Research depth: deep

References (8)

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock Pro Content

Get the full detection package for T1134.004 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Detect Parent PID Spoofing in Google Chronicle

MITRE ATT&CK

YARA-L Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1134.004

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Defense Evasion

Popular Detections

MITRE ATT&CK

YARA-L Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1134.004

Testing Methodology

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Defense Evasion

Popular Detections

Get new detections in your inbox