huntrule

Windows Detect SelectMyParent.exe Execution for PPID Spoofing

Flags SelectMyParent.exe process creation with PPID spoofing command-line and metadata indicators on Windows.

FreeUnreviewedSigmahighv1
title: Windows Detect SelectMyParent.exe Execution for PPID Spoofing
id: 8d56462f-f3fb-4163-907a-4239984f780f
status: test
description: This rule identifies execution of the SelectMyParent utility by matching the executable name, related command-line indicators for PPID spoofing, and additional file metadata fields (OriginalFileName, Description, and specific IMPHASH values). Parent process ID spoofing is used to evade detection and mislead process ancestry-based monitoring during stealthy activity. It relies on Windows process creation telemetry including Image path, CommandLine, OriginalFileName, Description, and file hash/IMPHASH fields.
references:
  - https://pentestlab.blog/2020/02/24/parent-pid-spoofing/
  - https://www.picussecurity.com/resource/blog/how-to-detect-parent-pid-ppid-spoofing-attacks
  - https://www.ired.team/offensive-security/defense-evasion/parent-process-id-ppid-spoofing
  - https://www.virustotal.com/gui/search/filename%253A*spoof*%2520filename%253A*ppid*/files
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_selectmyparent.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-07-23
modified: 2024-11-23
tags:
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1134.004
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Image|endswith: \SelectMyParent.exe
    - CommandLine|contains:
        - PPID-spoof
        - ppid_spoof
        - spoof-ppid
        - spoof_ppid
        - ppidspoof
        - spoofppid
        - spoofedppid
        - " -spawnto "
    - OriginalFileName|contains:
        - PPID-spoof
        - ppid_spoof
        - spoof-ppid
        - spoof_ppid
        - ppidspoof
        - spoofppid
        - spoofedppid
    - Description: SelectMyParent
    - Hashes|contains:
        - IMPHASH=04D974875BD225F00902B4CAD9AF3FBC
        - IMPHASH=A782AF154C9E743DDF3F3EB2B8F3D16E
        - IMPHASH=89059503D7FBF470E68F7E63313DA3AD
        - IMPHASH=CA28337632625C8281AB8A130B3D6BAD
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 52ff7941-8211-46f9-84f8-9903efb7077d
    type: derived

What it detects

This rule identifies execution of the SelectMyParent utility by matching the executable name, related command-line indicators for PPID spoofing, and additional file metadata fields (OriginalFileName, Description, and specific IMPHASH values). Parent process ID spoofing is used to evade detection and mislead process ancestry-based monitoring during stealthy activity. It relies on Windows process creation telemetry including Image path, CommandLine, OriginalFileName, Description, and file hash/IMPHASH fields.

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.