What child is this?
Summary
Yarden Shafir explains Windows process reparenting: how child processes can appear under a different parent than the one calling CreateProcess, why ProcMon shows misleading stacks like explorer.exe spawning Windows Terminal, and how both attackers and legitimate apps use it.
- Published
- Collected
--- id: 1717 title: "What child is this?" source_domain: blog.trailofbits.com source_url: "https://blog.trailofbits.com/2022/12/20/process-reparenting-microsoft-windows/" published_at: "2022-12-20T13:00:25Z" tags: ["windows", "security-research", "program-analysis"] phying_url: "https://phying.com/item/1717" lang: en --- # What child is this? ## Summary Yarden Shafir explains Windows process reparenting: how child processes can appear under a different parent than the one calling CreateProcess, why ProcMon shows misleading stacks like explorer.exe spawning Windows Terminal, and how both attackers and legitimate apps use it. ## Intelligence Metadata - **Sources:** blog.trailofbits.com - **Published:** 2022-12-20T13:00:25Z - **Original:** https://blog.trailofbits.com/2022/12/20/process-reparenting-microsoft-windows/ - **Phying News:** https://phying.com/item/1717