Parent Process Detection

Created the Monday 18 March 2019. Updated 6 months, 3 weeks ago.

Parent process is a technique used by malware to evade detection by security analysts. The parent process of a given process is the process that spawned it.

For example, most user processes on a Windows system have explorer.exe as their parent process. By checking the parent process of a given process, malware can determine whether it is being monitored by security analysts. If the parent process is not explorer.exe, then the process is likely being monitored and the malware can take evasive action, such as terminating itself.

Technique Identifier

U0404

Technique Tags

Process Spawn Explorer.exe Monitoring Evasive action Termination Encryption

Featured Windows API's

Below, you will find a list of the most commonly used Windows API's that are currently utilized by malware authors for current evasion technique. This list is meant to provide an overview of the API's that are commonly used for this purpose. If there are any API's that you feel should be included on this list, please do not hesitate to contact us. We will be happy to update the list and provide any additional information or documentation that may be helpful.

Code Snippets

Description

This code uses the CreateToolhelp32Snapshot() and Process32First()/Process32Next() functions to iterate over all processes in the system and find the one with the same ID as the current process. It then checks the parent process ID of the current process, and compares it to 0 (the process ID of explorer.exe), to determine whether the parent process is explorer.exe or not. If the parent process is not explorer.exe, then the process is likely being monitored and the malware can take evasive action.

#include <Windows.h>
#include <TlHelp32.h>
#include <iostream>

int main()
{
    // Get the current process ID
    DWORD currentPID = GetCurrentProcessId();

    // Create a snapshot of all processes in the system
    HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);

    // Initialize the process entry structure
    PROCESSENTRY32 entry;
    entry.dwSize = sizeof(entry);

    // Iterate over all processes in the snapshot
    if (Process32First(snapshot, &entry))
    {
        do
        {
            // Check if the current process is the one we're looking for
            if (entry.th32ProcessID == currentPID)
            {
                // The parent process ID is the one we want
                DWORD parentPID = entry.th32ParentProcessID;

                // Check if the parent process is explorer.exe
                if (parentPID == 0)
                {
                    std::cout << "Parent process is explorer.exe" << std::endl;
                }
                else
                {
                    std::cout << "Parent process is not explorer.exe" << std::endl;
                }

                break;
            }
        } while (Process32Next(snapshot, &entry));
    }

    // Clean up
    CloseHandle(snapshot);

    return 0;
}

Detection Rules

                                    rule ParentProcessEvasion
{
    strings:
        // Check for the CreateToolhelp32Snapshot() function call
        $create_snapshot = "CreateToolhelp32Snapshot"

        // Check for the Process32First() function call
        $process32_first = "Process32First"

        // Check for the Process32Next() function call
        $process32_next = "Process32Next"

        // Check for the GetCurrentProcessId() function call
        $get_current_pid = "GetCurrentProcessId"

    condition:
        // Check if all the required strings are present in the code
        all of them
}

Additional Resources

External Links

The resources provided below are associated links that will give you even more detailed information and research on current evasion technique. It is important to note that, while these resources may be helpful, it is important to exercise caution when following external links. As always, be careful when clicking on links from unknown sources, as they may lead to malicious content.

Detecting Malicious Processes Using Psinfo Volatility Plugin - Cysinfo