LOLBAS process reports a sensitive system process as its parent

1title: LOLBAS process reports a sensitive system process as its parent2id: dad089c3-608a-4dc6-95f7-3484a63522dd3status: experimental4description: |5  AN1351's actual observable is a mismatch across three independent lineage6  sources — ETW EventHeader ProcessId, Security 4688 Creator Process ID/Name7  and Sysmon ParentProcessGuid — but the brief supplies only one of those8  three (Security 4688), so no cross-source mismatch can be computed here;9  once PPID spoofing succeeds, 4688's own ParentProcessName field reports10  exactly the forged value, indistinguishable within that single event from a11  genuine parent. What this rule detects instead is MITRE's SensitiveParents12  knob turned into a plausibility check: it names lsass.exe, services.exe and13  wininit.exe as the example SYSTEM processes whose spoofed use "auto-14  escalates severity"; this rule adds smss.exe and csrss.exe, the two other15  session/boot-manager processes in the same trust tier, none of which16  legitimately parents an interactive shell or a LOLBAS binary. A match here17  means either a genuinely forged PPID pointing at one of these five, or one18  of the narrower legitimate exceptions named below — the rule cannot tell19  the two apart, since both produce the same 4688 record. It also cannot see20  the UpdateProcThreadAttribute/PROC_THREAD_ATTRIBUTE_PARENT_PROCESS call21  itself, or a spoofed PPID pointing at an ordinary (non-sensitive) process22  such as explorer.exe, which is the case MITRE's own example (a document23  spawning PowerShell spoofed to look like it came from explorer.exe) — that24  variant is indistinguishable from the enormous volume of processes explorer25  legitimately parents and is not attempted. Prerequisite: 4688 needs *Audit26  Process Creation* enabled; it is off by default and in the CIS baseline.27  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0489, not hand-written and not tested by its author. Any lab result is on this rule's own page.28references:29  - https://attack.mitre.org/techniques/T1134/00430  - https://attack.mitre.org/detectionstrategies/DET048931author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)32date: 2026-08-1833tags:34  - attack.defense-evasion35  - attack.privilege-escalation36  - attack.t1134.00437logsource:38  category: process_creation39  product: windows40detection:41  selection_child:42    Image|endswith:43      - '\cmd.exe'44      - '\powershell.exe'45      - '\pwsh.exe'46      - '\rundll32.exe'47      - '\regsvr32.exe'48      - '\mshta.exe'49      - '\wscript.exe'50      - '\cscript.exe'51  selection_sensitive_parent:52    ParentImage|endswith:53      - '\lsass.exe'54      - '\services.exe'55      - '\wininit.exe'56      - '\smss.exe'57      - '\csrss.exe'58  condition: selection_child and selection_sensitive_parent59falsepositives:60  - "Legacy backup, monitoring or scheduled-task services whose ImagePath directly invokes cmd.exe or powershell.exe as the service binary itself, rather than hosting it under svchost.exe — the Service Control Manager (services.exe) is the recorded parent for any such service at every start, and is the single most common benign match for this rule."61  - "Component-registration or configuration services deployed by Group Policy or MDM whose service binary is rundll32.exe or regsvr32.exe directly, again parented by services.exe as the Service Control Manager."62  - "Windows Recovery Environment, in-place upgrade and system-repair tooling in which smss.exe or wininit.exe transiently parents a command interpreter during very early boot or repair phases — rare, but a documented benign edge case distinct from a running production endpoint."63level: medium