Skip to content
Threat Feed

Tag

Parent-Pid-Spoofing

1 brief RSS
medium advisory

Unusual Parent-Child Relationship Detection

This rule identifies Windows programs run from unexpected parent processes, which could indicate masquerading or other strange activity on a system, potentially indicating process injection, masquerading, access token manipulation, or parent PID spoofing.

Microsoft Defender XDR +1 privilege-escalation defense-evasion windows process-injection masquerading access-token-manipulation parent-pid-spoofing
3r 4t