Consider Parent PID spoofing

[John Lambert]

Raccine/raccine.cpp

Line 223 in b8ea99a

 pid = getppid(pid); 

You may want to check out this article on parent pid spoofing.
https://pentestlab.blog/2020/02/24/parent-pid-spoofing/

[Ollie]

is there any reasonable user land way to detect @JohnLaTwC ?

[Ollie]

the only the way I can see to detect PPID spoofing is via ETW..

[Branislav Đalić]

Afaik, UAC will also spoof your parent process by using svchost service name.

[Giuseppe Massaro]

reference to what @olliencc and @Omodaka9375 said about parent pid spoofing: https://blog.f-secure.com/detecting-parent-pid-spoofing/

[Gulhanburcu]

Tüm işlemleri iptal etmek istiyorum