Usage of SelectMyParent HackTool for PPID Spoofing

SelectMyParent is a well-known offensive security tool used to conduct PPID spoofing. By manipulating the parent process ID attribute during process creation, attackers can associate a malicious process with a legitimate parent process, such as explorer.exe or services.exe. This technique is primarily utilized for defense evasion and privilege escalation, as it complicates forensic analysis and helps bypass parent-child process relationship monitoring. The tool allows operators to specify a target process to act as the parent for a newly spawned executable. Security operations teams should monitor for the execution of this binary or its associated command-line parameters in environments where such activity is not part of authorized penetration testing or security assessments.

Attack Chain

1. Attacker delivers the SelectMyParent binary to a compromised endpoint.
2. Attacker identifies a target process (e.g., explorer.exe) to adopt as the parent.
3. Attacker executes SelectMyParent.exe with the target PID and the malicious payload path.
4. The tool invokes the Windows API 'CreateProcess' with 'EXTENDED_STARTUPINFO_PRESENT' flag set.
5. The 'PROC_THREAD_ATTRIBUTE_PARENT_PROCESS' attribute is updated with the target PID.
6. The child process is created, successfully inheriting the spoofed parent process identity.
7. The malicious payload executes under the spoofed parent context, hiding its true origin.

Impact

The use of PPID spoofing enables attackers to maintain persistence and execute malicious code while blending into legitimate process trees. This can lead to unauthorized access, exfiltration of sensitive data, and further lateral movement within a compromised network. If successful, the attacker gains a stealthier footprint that is difficult to detect using standard EDR parent-child relationship alerts.

Recommendation

• Deploy the provided Sigma rule to detect the execution of SelectMyParent and associated command-line arguments.
• Enable Sysmon process creation logging (Event ID 1) across all Windows endpoints to capture command-line arguments and process metadata.
• Audit endpoint telemetry for suspicious process creation patterns where the parent process does not logically correspond to the spawned child process.
• Review all alerts generated by this rule, as there is little to no legitimate use for PPID spoofing tools in production environments.