---
id: 1717
title: "What child is this?"
source_domain: blog.trailofbits.com
source_url: "https://blog.trailofbits.com/2022/12/20/process-reparenting-microsoft-windows/"
published_at: "2022-12-20T13:00:25Z"
tags: ["windows", "security-research", "program-analysis"]
phying_url: "https://phying.com/item/1717"
lang: en
---

# What child is this?

## Summary

Yarden Shafir explains Windows process reparenting: how child processes can appear under a different parent than the one calling CreateProcess, why ProcMon shows misleading stacks like explorer.exe spawning Windows Terminal, and how both attackers and legitimate apps use it.

## Intelligence Metadata

- **Sources:** blog.trailofbits.com
- **Published:** 2022-12-20T13:00:25Z
- **Original:** https://blog.trailofbits.com/2022/12/20/process-reparenting-microsoft-windows/
- **Phying News:** https://phying.com/item/1717