Consider Parent PID spoofing

[JohnLaTwC]

Raccine/raccine.cpp

Line 223 in b8ea99a

pid = getppid(pid);

You may want to check out this article on parent pid spoofing.
https://pentestlab.blog/2020/02/24/parent-pid-spoofing/

[olliencc]

is there any reasonable user land way to detect @JohnLaTwC ?

[olliencc]

the only the way I can see to detect PPID spoofing is via ETW..

[Omodaka9375]

Afaik, UAC will also spoof your parent process by using svchost service name.

[N3mes1s]

reference to what @olliencc and @Omodaka9375 said about parent pid spoofing: https://blog.f-secure.com/detecting-parent-pid-spoofing/

[Gulhanburcu]

Tüm işlemleri iptal etmek istiyorum