(YARA) YARA_DetectParentProcess
rule ParentProcessEvasion
{
strings:
// Check for the CreateToolhelp32Snapshot() function call
$create_snapshot = "CreateToolhelp32Snapshot"
// Check for the Process32First() function call
$process32_first = "Process32First"
// Check for the Process32Next() function call
$process32_next = "Process32Next"
// Check for the GetCurrentProcessId() function call
$get_current_pid = "GetCurrentProcessId"
condition:
// Check if all the required strings are present in the code
all of them
}
Associated Techniques
| Technique Name | Technique ID's | Snippet(s) | OS |
|---|---|---|---|
| Parent Process Detection | U0404 |
Matching Samples 10 most recent
| Sample Name | Matching Techniques | First Seen | Last Seen |
|---|---|---|---|
| frostygoop.exe | 7 | 2025-10-24 | 4 days, 16 hours ago |
| MBSetup (3).exe | 6 | 2025-10-18 | 1 week, 3 days ago |
| ri_setup_full4134_UjiwJcEu.exe | 7 | 2025-10-02 | 3 weeks, 5 days ago |
| Yandex.exe | 8 | 2025-09-20 | 1 month, 1 week ago |
| test.exe | 8 | 2025-09-20 | 1 month, 1 week ago |
| 0b98de4fbe9e42aa1b79f642c241...ac19b3fc5400705cfba61968.exe | 5 | 2025-08-13 | 2 months, 2 weeks ago |
| Клиент.exe | 9 | 2025-07-01 | 3 months, 3 weeks ago |
| test.exe | 7 | 2025-06-20 | 4 months, 1 week ago |
| RuntimeBroker.exe | 11 | 2025-06-05 | 4 months, 3 weeks ago |
| tel.exe | 13 | 2025-06-01 | 4 months, 3 weeks ago |
Created
December 7, 2022
Last Revised
December 7, 2022