LOLBAS process reports a sensitive system process as its parent

Siemphony@siemphonymediumT1134.004unverified

AN1351's actual observable is a mismatch across three independent lineage sources — ETW EventHeader ProcessId, Security 4688 Creator Process ID/Name and Sysmon ParentProcessGuid — but the brief supplies only one of those three (Security 4688), so no cross-source mismatch can be computed here; once PPID spoofing succeeds, 4688's own ParentProcessName field reports exactly the forged value, indistinguishable within that single event from a genuine parent. What this rule detects instead is MITRE's SensitiveParents knob turned into a plausibility check: it names lsass.exe, services.exe and wininit.exe as the example SYSTEM processes whose spoofed use "auto- escalates severity"; this rule adds smss.exe and csrss.exe, the two other session/boot-manager processes in the same trust tier, none of which legitimately parents an interactive shell or a LOLBAS binary. A match here means either a genuinely forged PPID pointing at one of these five, or one of the narrower legitimate exceptions named below — the rule cannot tell the two apart, since both produce the same 4688 record. It also cannot see the UpdateProcThreadAttribute/PROC_THREAD_ATTRIBUTE_PARENT_PROCESS call itself, or a spoofed PPID pointing at an ordinary (non-sensitive) process such as explorer.exe, which is the case MITRE's own example (a document spawning PowerShell spoofed to look like it came from explorer.exe) — that variant is indistinguishable from the enormous volume of processes explorer legitimately parents and is not attempted. Prerequisite: 4688 needs *Audit Process Creation* enabled; it is off by default and in the CIS baseline. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0489, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((FolderPath endswith "\\cmd.exe" or FolderPath endswith "\\powershell.exe" or FolderPath endswith "\\pwsh.exe" or FolderPath endswith "\\rundll32.exe" or FolderPath endswith "\\regsvr32.exe" or FolderPath endswith "\\mshta.exe" or FolderPath endswith "\\wscript.exe" or FolderPath endswith "\\cscript.exe") and (InitiatingProcessFolderPath endswith "\\lsass.exe" or InitiatingProcessFolderPath endswith "\\services.exe" or InitiatingProcessFolderPath endswith "\\wininit.exe" or InitiatingProcessFolderPath endswith "\\smss.exe" or InitiatingProcessFolderPath endswith "\\csrss.exe"))

Splunk · SPL

Run this as a search.

index=* ((Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\rundll32.exe" OR Image="*\\regsvr32.exe" OR Image="*\\mshta.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe") AND (ParentImage="*\\lsass.exe" OR ParentImage="*\\services.exe" OR ParentImage="*\\wininit.exe" OR ParentImage="*\\smss.exe" OR ParentImage="*\\csrss.exe"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.executable) LIKE "*\\\\cmd.exe" OR TO_LOWER(process.executable) LIKE "*\\\\powershell.exe" OR TO_LOWER(process.executable) LIKE "*\\\\pwsh.exe" OR TO_LOWER(process.executable) LIKE "*\\\\rundll32.exe" OR TO_LOWER(process.executable) LIKE "*\\\\regsvr32.exe" OR TO_LOWER(process.executable) LIKE "*\\\\mshta.exe" OR TO_LOWER(process.executable) LIKE "*\\\\wscript.exe" OR TO_LOWER(process.executable) LIKE "*\\\\cscript.exe") AND (TO_LOWER(process.parent.executable) LIKE "*\\\\lsass.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\services.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\wininit.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\smss.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\csrss.exe"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\cmd\.exe$|\\powershell\.exe$|\\pwsh\.exe$|\\rundll32\.exe$|\\regsvr32\.exe$|\\mshta\.exe$|\\wscript\.exe$|\\cscript\.exe$)</field>    <field name="ParentImage" type="pcre2">(?i)(\\lsass\.exe$|\\services\.exe$|\\wininit\.exe$|\\smss\.exe$|\\csrss\.exe$)</field>    <description>LOLBAS process reports a sensitive system process as its parent</description>    <mitre>      <id>T1134.004</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: process_injection
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: dad089c3-608a-4dc6-95f7-3484a63522dd

ATT&CKT1134.004

T1134.004Parent PID Spoofing

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonprocess injection

process injectionAI draft — unreviewed

01 · What this rule detects

AN1351's real observable is a mismatch across three independent lineage sources — ETW EventHeader ProcessId, Security 4688 Creator Process ID/Name, and Sysmon ParentProcessGuid. The brief only supplies one of those three (Security 4688), so no cross-source mismatch can be computed at all: once PPID spoofing succeeds, 4688's own ParentProcessName field reports exactly the forged value, indistinguishable within that single event from a genuine parent. What this rule detects instead is MITRE's SensitiveParents knob turned into a plausibility check, not a spoofing-specific detector.

02 · Telemetry you need

Security 4688 process-creation events, which require Audit Process Creation — off by default and in the CIS baseline. A match here means either a genuinely forged PPID pointing at one of the five sensitive processes below, or one of the narrower legitimate exceptions this lesson lists — the rule structurally cannot tell the two apart, since both produce the same 4688 record.

03 · How the logic works

selection_child matches Image ending in one of eight LOLBAS-style binaries: cmd.exe, powershell.exe, pwsh.exe, rundll32.exe, regsvr32.exe, mshta.exe, wscript.exe, cscript.exe. selection_sensitive_parent matches ParentImage ending in lsass.exe, services.exe, wininit.exe, smss.exe, or csrss.exe. MITRE names only the first three as its SensitiveParents example — "auto-escalates severity" when spoofed use of them is detected. The rule author added smss.exe and csrss.exe, the two other session/boot-manager processes in the same trust tier, none of which legitimately parents an interactive shell or LOLBAS binary; this addition is disclosed in the description, not attributed to MITRE. The condition is selection_child and selection_sensitive_parent. What this cannot see: the UpdateProcThreadAttribute / PROC_THREAD_ATTRIBUTE_PARENT_PROCESS call itself, and — the case MITRE's own example actually uses — a spoofed PPID pointing at an ordinary process such as explorer.exe (a document spawning PowerShell spoofed to look like it came from Explorer). That variant is indistinguishable from the enormous volume of processes Explorer legitimately parents and isn't attempted here; only the sensitive-parent case is.

04 · Common false positives

Legacy backup, monitoring or scheduled-task services whose ImagePath
Component-registration or configuration services deployed by GPO/MDM
WinRE, in-place upgrade and system-repair tooling where smss.exe or

05 · Detection maturity

tier_1: Unverified — this rule has never fired against real data. It is a plausibility heuristic, not a confirmed detector of PPID spoofing, and belongs at the lowest DeBMM tier until run and tuned against your own telemetry.

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Build an allowlist of known legacy-service ImagePaths that legitimately run cmd.exe/powershell.exe/rundll32.exe under services.exe, and suppress those first — they will dominate the alert volume. Consider adding TokenElevationType or SubjectLogonId context that 4688 also carries to narrow further.

Declared by the author

Legacy backup, monitoring or scheduled-task services whose ImagePath directly invokes cmd.exe or powershell.exe as the service binary itself, rather than hosting it under svchost.exe — the Service Control Manager (services.exe) is the recorded parent for any such service at every start, and is the single most common benign match for this rule.
Component-registration or configuration services deployed by Group Policy or MDM whose service binary is rundll32.exe or regsvr32.exe directly, again parented by services.exe as the Service Control Manager.
Windows Recovery Environment, in-place upgrade and system-repair tooling in which smss.exe or wininit.exe transiently parents a command interpreter during very early boot or repair phases — rare, but a documented benign edge case distinct from a running production endpoint.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1134.004, evaluated against their process_creation events.

Share this rule

/u/siemphony/dad089c3-608a-4dc6-95f7-3484a63522dd

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

LOLBAS process reports a sensitive system process as its parent

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it