StrikeShark PPID Spoofing - Cobalt Strike Spawning Shells Under Spoofed Parents
Detects evidence of PPID spoofing associated with the StrikeShark/Cobalt Strike framework. The detection identifies suspicious child processes (e.g., cmd.exe, powershell.exe) originating from common system processes (e.g., explorer.exe, svchost.exe) while the actual ancestor is a malicious SystemSettings.exe binary located in non-standard AppData paths. It correlates these process events with account mismatches between the spoofed parent and child process, indicating CreateProcessWithTokenW usage for token impersonation.
Microsoft Sentinel (KQL)
