HackTool - PPID Spoofing SelectMyParent Tool Execution

Severity: high
Author: Florian Roth (Nextron Systems)
Source: upstream

Detects the use of parent process ID spoofing tools like Didier Stevens tool SelectMyParent

MITRE ATT&CK coverage

Tactic	Techniques
Privilege Escalation	`T1134.004` Access Token Manipulation: Parent PID Spoofing
Defense Evasion	`T1134.004` Access Token Manipulation: Parent PID Spoofing

Event coverage

Provider	Event ID	Title
Sysmon	1	Process creation

Stages and Predicates

Stage 1: `selection`

or:
CommandLine|contains: ' -spawnto '
CommandLine|contains: PPID-spoof
CommandLine|contains: ppid_spoof
CommandLine|contains: ppidspoof
CommandLine|contains: spoof-ppid
CommandLine|contains: spoof_ppid
CommandLine|contains: spoofedppid
CommandLine|contains: spoofppid
Description: SelectMyParent
Hashes|contains: 'IMPHASH=04D974875BD225F00902B4CAD9AF3FBC'
Hashes|contains: 'IMPHASH=89059503D7FBF470E68F7E63313DA3AD'
Hashes|contains: 'IMPHASH=A782AF154C9E743DDF3F3EB2B8F3D16E'
Hashes|contains: 'IMPHASH=CA28337632625C8281AB8A130B3D6BAD'
Image|endswith: '\SelectMyParent.exe'
OriginalFileName|contains: PPID-spoof
OriginalFileName|contains: ppid_spoof
OriginalFileName|contains: ppidspoof
OriginalFileName|contains: spoof-ppid
OriginalFileName|contains: spoof_ppid
OriginalFileName|contains: spoofedppid
OriginalFileName|contains: spoofppid

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.