HackTool - PPID Spoofing SelectMyParent Tool Execution
This rule detects the execution of tools designed for Parent Process ID (PPID) spoofing, specifically targeting Didier Stevens' 'SelectMyParent' tool. It identifies these tools through their executable name, specific command-line arguments, original file names, and known IMPHASH values. PPID spoofing is a defense evasion technique where a new process is created with a manipulated parent process ID to obscure its true origin, often to bypass security monitoring or elevate privileges.
Sigma
