Parent PID Spoofing via UpdateProcThreadAttribute
This rule detects potential parent PID spoofing attempts by monitoring HTTP traffic for the presence of specific Windows API calls related to process creation and attribute modification. Specifically, it looks for 'UpdateProcThreadAttribute' and 'PROC_THREAD_ATTRIBUTE_PARENT_PROCESS' in the file data of HTTP responses, indicating that a client might be receiving instructions or code to perform parent PID spoofing.
Suricata
