Techniques › T1134.004 › AN1351
AN1351 Analytic 1351
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>A process explicitly forges its parent using EXTENDED_STARTUPINFO + PROC_THREAD_ATTRIBUTE_PARENT_PROCESS (UpdateProcThreadAttribute → CreateProcess[A/W]/CreateProcessAsUserW) or other Native API paths, resulting in mismatched/implausible lineage across ETW EventHeader ProcessId, Security 4688 Creator Process ID/Name, and sysmon ParentProcessGuid. Often paired with privilege escalation when the chosen parent runs as SYSTEM.</p>
- Detects
- T1134.004 Parent PID Spoofing
- Part of
- DET0489 Behavior-chain detection for T1134.004 Access Token Manipulation: Parent PID Spoofing (Windows)
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Security | EventCode=4688 | DC0032 Process Creation |
| etw:Microsoft-Windows-Kernel-Process | api_call: UpdateProcThreadAttribute (PROC_THREAD_ATTRIBUTE_PARENT_PROCESS) and CreateProcess* with EXTENDED_STARTUPINFO_PRESENT / StartupInfoEx | DC0021 OS API Execution |
| etw:Microsoft-Windows-Kernel-Process | process_start: EventHeader.ProcessId true parent vs reported PPID mismatch | DC0034 Process Metadata |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
TimeWindow | Correlation window between UpdateProcThreadAttribute/CreateProcess* and the resulting process (default 5–10 minutes). |
AllowedSpoofers | Legitimate binaries that commonly use StartupInfoEx/PPID assignment (e.g., consent.exe, svchost.exe during UAC). |
ParentPrivilegeDeltaThreshold | Minimum privilege/integrity gap between chosen parent and real caller to raise severity. |
LineageMismatchTolerance | Number of mismatched sources (0–3) before alerting to reduce noise. |
SensitiveParents | List of SYSTEM parents that, if spoofed, auto‑escalate severity (e.g., lsass.exe, services.exe, wininit.exe). |