Parent Process ID Spoofing

The subject causes a newly created process to record or present a false parent process identifier, obscuring the process responsible for initiating the activity. This creates a misleading parent-child relationship within process trees and may cause unauthorized execution to appear as though it originated from a trusted, routine, or unrelated process. This Section concerns the deliberate falsification of process ancestry to evade monitoring, conceal the origin of execution, or frustrate subsequent investigation.

Parent process ID spoofing can undermine detections based on expected process lineage and complicate forensic reconstruction of the execution chain. The subject may use process-creation application programming interfaces or specialist tooling to assign an alternate parent process when launching code.