Skip to content
Threat Feed
Subscribe

Product

Windows Operating System

3 briefs RSS
high advisory

Privileges Elevation via Parent Process PID Spoofing

Adversaries utilize parent process ID (PPID) spoofing on Windows systems to create elevated child processes, typically to SYSTEM privileges, thereby evading process monitoring defenses and facilitating privilege escalation.

Windows Operating System privilege-escalation ppid-spoofing windows evasion elastic-defend
1t
medium advisory

Service Reconnaissance Via Wmic.EXE

Adversaries leverage the native Windows Management Instrumentation Command-line (WMIC) utility to perform service reconnaissance on remote systems, querying for existing services as a prelude to identifying potential targets for lateral movement or privilege escalation.

Windows Operating System windows reconnaissance wmic internal-recon
1r 1t
high advisory

Suspicious Execution from Mounted Device

This threat brief covers the detection of suspicious executables running from mounted devices, a common tactic used for defense evasion and malware deployment.

Windows Operating System defense-evasion execution mounted-device
3r 2t