ATT&CK technique
View on MITRE ATT&CK →
T1134.004
Parent PID Spoofing
StealthPrivilege Escalation
6 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| splunk | Windows Parent PID Spoofing with Explorer | production | 2026-10-02 |
| elastic | Parent Process PID Spoofing | production | 2026-09-18 |
| elastic | Unusual Parent-Child Relationship | production | 2026-09-18 |
| elastic | Privileges Elevation via Parent Process PID Spoofing | production | 2026-09-18 |
| splunk | Wscript Or Cscript Suspicious Child Process | production | 2026-07-20 |
| sigma | HackTool - PPID Spoofing SelectMyParent Tool Execution | test | 2024-11-23 |