Loading story…
Windows parent process ID spoofing allows attackers to create a new process that appears to have been launched by a trusted parent such as explorer.exe, undermining detections based on parent-child process relationships. MITRE ATT&CK tracks the method as T1134.004, noting it can be used for both defense evasion and, in some cases, privilege escalation by assigning a privileged parent so the child may inherit an elevated token.
A published C++ proof of concept demonstrated the technique by using CreateProcess with extended startup attributes to set PROC_THREAD_ATTRIBUTE_PARENT_PROCESS, launching mspaint.exe in a suspended state, injecting a payload, queueing execution with APC, and then resuming the thread so the process appeared to be a child of explorer.exe. The walkthrough said the sample was detected by 20 of 70 VirusTotal engines and linked the tradecraft to real-world offensive tooling and malware, including Cobalt Strike and KONNI RAT, highlighting how adversaries can disguise execution chains that would otherwise look suspicious.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
A technical walkthrough demonstrated creating mspaint.exe with explorer.exe as a spoofed parent using CreateProcess extended attributes, then injecting code via APC into the suspended process. The author also reported that the compiled sample was detected by 20 of 70 VirusTotal engines.
MITRE ATT&CK published the Enterprise sub-technique T1134.004 covering Parent PID Spoofing as a Windows defense-evasion and privilege-escalation method.
The cocomelonc reference states that Didier Stevens introduced parent PID spoofing to a wider information security audience in 2009.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cocomelonc.github.io
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft and Elastic published technical details on **Process Ghosting** and related Windows executable image tampering techniques that let malware run after its backing file has been altered or deleted, bypassing antimalware scanning during a time-of-check/time-of-use gap in process creation. The technique abuses legacy process creation behavior, including use of the `NtCreateProcessEx` path, and is closely related to **process doppelganging**, **process herpaderping**, and **process reimaging**. Elastic described how an attacker can create a file, mark it delete-pending, write a payload, map it into an image section, close the handle so the file is removed, and then launch a process from the now fileless image section. Elastic reported that a proof-of-concept showed Windows Defender failing to scan a payload because the file was already delete-pending or deleted when scanning occurred, and said it had reported the issue to Microsoft’s MSRC, which replied that it did not meet the servicing bar. Microsoft later described a detection approach in **Microsoft Defender for Endpoint** that identifies processes created without the `GUID_ECP_CREATE_USER_PROCESS` extra create parameter and checks whether the executable image section lost disk coherency and became page-file-backed via `MmDoesFileHaveUserWritableReferences`. According to Microsoft, combining those signals enables detection of known and previously unpublished variants and can generate alerts for ghosting, herpaderping, and doppelganging seen in the wild.
Aug 15, 2026
A series of public proof-of-concept posts detailed how attackers can establish persistence on Windows by abusing multiple native mechanisms, including `AppInit_DLLs`, COM hijacking, Windows services, logon scripts, file-association changes, uninstall handlers, Event Viewer help links, shell `CLSID` command handlers, and Accessibility Features such as Sticky Keys. The demonstrations showed malware-like code modifying keys under `HKLM` and `HKCU` to force execution at boot, logon, application launch, or user interaction, with several techniques requiring administrator privileges while others worked in the current user context. The examples included replacing `.txt` open commands, setting `HKCU\Environment\UserInitMprLogonScript`, creating malicious `InprocServer32` registrations for COM objects, altering `UninstallString` values for installed software, redirecting Event Viewer online help to a local executable, and using either Image File Execution Options or symbolic links to hijack `sethc.exe`. The posts also tied several methods to known threat activity, citing groups and malware such as **APT28**, **APT39**, **Turla**, **Kimsuky**, **APT3**, **APT29**, **APT32**, **APT38**, **APT41**, Ramsay, Attor, Zebrocy, Mosquito, and SILENTTRINITY as examples of similar persistence tradecraft seen in the wild.
Aug 14, 2026
Researchers disclosed **Process Parameter Poisoning (P³)**, a Windows code-injection technique that stages malicious payloads inside a newly created process by abusing data copied during `CreateProcessW`, including the command line, environment block, and `STARTUPINFO.lpReserved` fields. Instead of relying on heavily monitored APIs such as `WriteProcessMemory` and `VirtualAllocEx`, the technique locates attacker-controlled data through the target process’s **PEB** and `RTL_USER_PROCESS_PARAMETERS`, then prepares it for execution inside the remote process. A public proof of concept, **`p3-loader`** from Orange Cyberdefense, demonstrates redirecting the target process’s main thread with `NtSetContextThread` after changing memory protections, avoiding classic remote-thread creation and reducing common process-injection telemetry. SensePost reported that its implementation executed without alerts across four major EDR products even when process-injection protections were enabled, while both disclosures noted defender opportunities such as monitoring executable protections on process-parameter memory, anomalous process-creation parameters, remote reads of process parameters, and thread-context changes following protection updates.
Jul 8, 2026