PPID Spoofing via Security-Excluded Parent Process Inheritance
Detects instances where a process is spawned with a spoofed parent process ID (PPID) that points to a known security software or EDR component. Attackers perform this technique to inherit the security exclusions applied to trusted security processes, thereby effectively bypassing EDR/AV monitoring.
Sigma
