ATT&CK technique
View on MITRE ATT&CK →
T1036.009
Break Process Trees
Stealth
7 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | Process Backgrounded by Unusual Parent | production | 2026-10-08 |
| elastic | Tampering with RUNNER_TRACKING_ID in GitHub Actions Runners | production | 2026-09-18 |
| elastic | Direct Process Execution via Background Utility | production | 2026-09-18 |
| elastic | Unusual Execution from Kernel Thread (kthreadd) Parent | production | 2026-09-18 |
| elastic | Unusual Parent-Child Relationship | production | 2026-09-18 |
| splunk | Windows Unusual SysWOW64 Process Run System32 Executable | production | 2026-09-01 |
| splunk | Windows Svchost.exe Parent Process Anomaly | production | 2026-05-13 |