StrikeShark PPID Spoofing with Subsequent Privileged Process Access

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•5

Detects instances where a process launch exhibits PPID spoofing (where the reported parent PID does not match the actual creator PID) followed by that spoofed process attempting to access high-privileged system processes such as lsass.exe, services.exe, or winlogon.exe within a two-minute window. This behavior is indicative of privilege escalation attempts.