From 9dc206bc127afe10e7683df4fb0e0c140852861f Mon Sep 17 00:00:00 2001 From: Abdul Samad Date: Fri, 26 Jun 2026 17:06:44 +0500 Subject: [PATCH 1/4] feat: strengthen spoof parent PID rule with full PPID spoofing flow Fixes mandiant/capa-rules#1145 --- .../anti-forensic/spoof-parent-pid.yml | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/anti-analysis/anti-forensic/spoof-parent-pid.yml b/anti-analysis/anti-forensic/spoof-parent-pid.yml index 44aab7dd1..890296878 100644 --- a/anti-analysis/anti-forensic/spoof-parent-pid.yml +++ b/anti-analysis/anti-forensic/spoof-parent-pid.yml @@ -5,16 +5,29 @@ rule: namespace: anti-analysis/anti-forensic authors: - michael.hunhoff@mandiant.com + - itxsamad1 scopes: - static: basic block - dynamic: call + static: function + dynamic: span of calls att&ck: - Defense Evasion::Access Token Manipulation::Parent PID Spoofing [T1134.004] references: - https://blog.f-secure.com/detecting-parent-pid-spoofing/ + - https://attack.mitre.org/techniques/T1134/004/ examples: - 2ebadd04f0ada89c36c1409b6e96423a68dd77b513db8db3da203c36d3753e5f:0x140002291 features: - and: + - api: kernel32.InitializeProcThreadAttributeList - api: kernel32.UpdateProcThreadAttribute - number: 0x20000 = PROC_THREAD_ATTRIBUTE_PARENT_PROCESS + - or: + - api: kernel32.CreateProcess + - api: kernel32.CreateProcessA + - api: kernel32.CreateProcessW + - api: kernel32.CreateProcessAsUser + - api: kernel32.CreateProcessWithLogonW + - api: kernel32.CreateProcessWithTokenW + - api: advapi32.CreateProcessAsUser + - api: advapi32.CreateProcessWithLogon + - api: advapi32.CreateProcessWithToken From fe03d394d4e4fae1bde71e78fb33be3011bcc52a Mon Sep 17 00:00:00 2001 From: Abdul Samad Date: Fri, 26 Jun 2026 18:17:36 +0500 Subject: [PATCH 2/4] Update spoof parent PID example with verified PPID spoof PoC sample Point the rule example at the minimal test binary that demonstrates the full PPID spoofing API flow matched by the strengthened rule. --- anti-analysis/anti-forensic/spoof-parent-pid.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/anti-analysis/anti-forensic/spoof-parent-pid.yml b/anti-analysis/anti-forensic/spoof-parent-pid.yml index 890296878..03cc393b7 100644 --- a/anti-analysis/anti-forensic/spoof-parent-pid.yml +++ b/anti-analysis/anti-forensic/spoof-parent-pid.yml @@ -15,6 +15,7 @@ rule: - https://blog.f-secure.com/detecting-parent-pid-spoofing/ - https://attack.mitre.org/techniques/T1134/004/ examples: + - 7fc295b013cf773eb71e3de24944a7ca1e876846137cb6c6a758a26bbc1ce4f5:0x140001000 - 2ebadd04f0ada89c36c1409b6e96423a68dd77b513db8db3da203c36d3753e5f:0x140002291 features: - and: From 865863ab02fae4628f856dc74f208f613343a265 Mon Sep 17 00:00:00 2001 From: Abdul Samad Date: Fri, 26 Jun 2026 18:41:42 +0500 Subject: [PATCH 3/4] Update spoof parent PID example with verified PoC sample Add capa-testfiles sample 6538c46d... at function 0x140001450 that matches the strengthened rule. --- anti-analysis/anti-forensic/spoof-parent-pid.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/anti-analysis/anti-forensic/spoof-parent-pid.yml b/anti-analysis/anti-forensic/spoof-parent-pid.yml index 03cc393b7..4680b5611 100644 --- a/anti-analysis/anti-forensic/spoof-parent-pid.yml +++ b/anti-analysis/anti-forensic/spoof-parent-pid.yml @@ -15,7 +15,7 @@ rule: - https://blog.f-secure.com/detecting-parent-pid-spoofing/ - https://attack.mitre.org/techniques/T1134/004/ examples: - - 7fc295b013cf773eb71e3de24944a7ca1e876846137cb6c6a758a26bbc1ce4f5:0x140001000 + - 6538c46d9632ec5f7407de7918723c048e12e1f6883d1029d136da4a56d3c23a:0x140001450 - 2ebadd04f0ada89c36c1409b6e96423a68dd77b513db8db3da203c36d3753e5f:0x140002291 features: - and: From 0697bdb5e043a7ece0dc45b5e1550517fd2826f1 Mon Sep 17 00:00:00 2001 From: Abdul Samad Date: Fri, 26 Jun 2026 18:44:28 +0500 Subject: [PATCH 4/4] Update spoof parent PID example with verified PoC sample Replace placeholder example with capa-tested hash and function offset from minimal PPID spoof test binary (PR #1167). --- anti-analysis/anti-forensic/spoof-parent-pid.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/anti-analysis/anti-forensic/spoof-parent-pid.yml b/anti-analysis/anti-forensic/spoof-parent-pid.yml index 4680b5611..9b07dcc05 100644 --- a/anti-analysis/anti-forensic/spoof-parent-pid.yml +++ b/anti-analysis/anti-forensic/spoof-parent-pid.yml @@ -15,7 +15,7 @@ rule: - https://blog.f-secure.com/detecting-parent-pid-spoofing/ - https://attack.mitre.org/techniques/T1134/004/ examples: - - 6538c46d9632ec5f7407de7918723c048e12e1f6883d1029d136da4a56d3c23a:0x140001450 + - bfe31574ede658dcd647bcbcceee17cf10605a66fe8be366da94f90f4ed516a3:0x140001760 - 2ebadd04f0ada89c36c1409b6e96423a68dd77b513db8db3da203c36d3753e5f:0x140002291 features: - and: