Skip to content
Threat Feed
Subscribe

Tag

Ppid-Spoofing

2 briefs RSS
high advisory

Privileges Elevation via Parent Process PID Spoofing

Adversaries utilize parent process ID (PPID) spoofing on Windows systems to create elevated child processes, typically to SYSTEM privileges, thereby evading process monitoring defenses and facilitating privilege escalation.

Windows Operating System privilege-escalation ppid-spoofing windows evasion elastic-defend
1t
high advisory

Privilege Elevation via Parent Process PID Spoofing

This rule detects parent process spoofing used to create an elevated child process, specifically targeting privilege escalation to SYSTEM, where adversaries may spoof the parent process identifier (PPID) of a new process to evade process-monitoring defenses or to elevate privileges on Windows systems.

Elastic Endpoint +2 privilege-escalation windows ppid-spoofing
2r 1t