Windows: Detect SelectMyParent PPID Spoofing Tool Execution
Flags SelectMyParent.exe process creation with PPID spoofing command-line and metadata indicators on Windows.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-07-23
- Updated
- 2026-07-31
ATT&CK techniques
Priv Esc → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies execution of the SelectMyParent utility associated with parent process ID (PPID) spoofing, using both image path/name and command-line indicators. PPID spoofing is used to evade detection and make spawned processes appear to originate from a different parent process. It relies on Windows process creation telemetry, including process image names, command-line arguments, and optional OriginalFileName and IMPHASH values.
Reporting behind it
- pentestlab.bloghttps://pentestlab.blog/2020/02/24/parent-pid-spoofing/
- picussecurity.comhttps://www.picussecurity.com/resource/blog/how-to-detect-parent-pid-ppid-spoofing-attacks
- ired.teamhttps://www.ired.team/offensive-security/defense-evasion/parent-process-id-ppid-spoofing
- virustotal.comhttps://www.virustotal.com/gui/search/filename%253A*spoof*%2520filename%253A*ppid*/files
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_selectmyparent.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Detect SelectMyParent PPID Spoofing Tool Execution"
id: 8d56462f-f3fb-4163-907a-4239984f780f
status: test
description: This rule identifies execution of the SelectMyParent utility associated with parent process ID (PPID) spoofing, using both image path/name and command-line indicators. PPID spoofing is used to evade detection and make spawned processes appear to originate from a different parent process. It relies on Windows process creation telemetry, including process image names, command-line arguments, and optional OriginalFileName and IMPHASH values.
references:
- https://pentestlab.blog/2020/02/24/parent-pid-spoofing/
- https://www.picussecurity.com/resource/blog/how-to-detect-parent-pid-ppid-spoofing-attacks
- https://www.ired.team/offensive-security/defense-evasion/parent-process-id-ppid-spoofing
- https://www.virustotal.com/gui/search/filename%253A*spoof*%2520filename%253A*ppid*/files
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_selectmyparent.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-07-23
modified: 2024-11-23
tags:
- attack.privilege-escalation
- attack.stealth
- attack.t1134.004
logsource:
category: process_creation
product: windows
detection:
selection:
- Image|endswith: \SelectMyParent.exe
- CommandLine|contains:
- PPID-spoof
- ppid_spoof
- spoof-ppid
- spoof_ppid
- ppidspoof
- spoofppid
- spoofedppid
- " -spawnto "
- OriginalFileName|contains:
- PPID-spoof
- ppid_spoof
- spoof-ppid
- spoof_ppid
- ppidspoof
- spoofppid
- spoofedppid
- Description: SelectMyParent
- Hashes|contains:
- IMPHASH=04D974875BD225F00902B4CAD9AF3FBC
- IMPHASH=A782AF154C9E743DDF3F3EB2B8F3D16E
- IMPHASH=89059503D7FBF470E68F7E63313DA3AD
- IMPHASH=CA28337632625C8281AB8A130B3D6BAD
condition: selection
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: 52ff7941-8211-46f9-84f8-9903efb7077d
type: derived