Parent PID Spoofing via UpdateProcThreadAttribute
Detects parent process ID spoofing used to hide malicious process relationships
Microsoft Sentinel (KQL)

Detects parent process ID spoofing used to hide malicious process relationships

Already have an account?