Masquerading: Break Process Trees T1036.009

Tactic: Stealth

An adversary may attempt to evade process tree-based analysis by modifying executed malware's parent process ID (PPID). If endpoint protection software leverages the “parent-child" relationship for detection, breaking this relationship could result in the adversary’s behavior not being associated with previous process tree activity. On Unix-based systems breaking this process tree is common practice for administrators to execute software using scripts and programs.

Events covered

3 catalog events are tagged with this technique by at least one rule.

Authoring guide

Patterns shared across the 6 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (11 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

FieldRulesHowSample values
event.type4eq 4start
parent_process_name4eq 2, in 1, is_not_null 1, ne 1Runner.Listener, Runner.Worker, SearchProtocolHost.exe, autochk.exe, conhost.exe
process_name4eq 2, in 2bash, csh, autochk.exe, consent.exe, csrss.exe
CommandLine3contains 2, ne 1, wildcard 1*/home/*/.ssh/*, /dev/shm/, /dev/tcp/, unknown, windows\\system32\\
EventType3in 2, eq 1exec, ProcessRollup2, exec_event
host.os.type3eq 2, in 1
Image2contains 1, starts_with 1/dev/shm/, /tmp/, /var/tmp/, \\windows\\syswow64\\
event.category2eq 2process
ParentImage1ne 1c:\\program files\\windows defender\\msmpeng.exe, c:\\programdata\\microsoft\\windows...
process.args1ends_with 1, eq 1&, -c
process.env_vars1starts_with 1RUNNER_TRACKING_ID

Top indicator values (89 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

FieldKindValueRules (here)Corpus reach
event.typeeq
start
4606
EventTypein
ProcessRollup2
2117
EventTypein
exec
2171
event.categoryeq
process
2128
process_nameeq
svchost.exe
211
process_namein
bash
288
process_namein
csh
271
process_namein
dash
278
process_namein
fish
272
process_namein
ksh
273
process_namein
sh
283
process_namein
tcsh
269
process_namein
zsh
282
CommandLinecontains
/dev/shm/
12
CommandLinecontains
/dev/tcp/
12
CommandLinecontains
/etc/init.d
12
CommandLinecontains
/etc/ld.so
1
CommandLinecontains
/etc/profile
1
CommandLinecontains
/etc/rc.local
1
CommandLinecontains
/etc/shadow
14
CommandLinecontains
/etc/ssh
1
CommandLinecontains
/etc/sudoers
16
CommandLinecontains
/root/.ssh
1
CommandLinecontains
/tmp/
19
CommandLinecontains
/var/log/
1
CommandLinecontains
/var/run/
1
CommandLinecontains
/var/tmp/
1
CommandLinecontains
/var/www/
1
CommandLinecontains
base64
111
CommandLinecontains
cron
1

Exclusions (37 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

FieldKindValueRules excluding
CommandLinecontains
/bin/ps
1
CommandLinecontains
/usr/bin/find
1
CommandLinecontains
/usr/bin/grep
1
CommandLinecontains
ds_agent
1
CommandLinecontains
gitlabrunner
1
CommandLinecontains
nagios
1
CommandLinecontains
omsagent
1
CommandLinecontains
pgrep
1
CommandLineeq
sh -c /bin/true
1
Imageeq
/lib/systemd/systemd-cgroups-agent
1
Imageeq
/proc/self/exe
1
Imageeq
/usr/local/axs-haproxy-monitoring/haproxy_stats.sh
1
Imagestarts_with
/tmp/newroot/
1
Imagestarts_with
/var/lib/docker/overlay2/
1
Imagestarts_with
/vz/root/
1

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Platform (all)
Domain (all)

Elastic 4 rules

Splunk 2 rules