Parent-PID-Spoofing

PPID Spoofing Overview Welcome to the PPID Spoofing repository! This project demonstrates a technique used to manipulate the Process Parent ID (PPID) of newly created processes. By spoofing the PPID, malicious processes can blend in with legitimate processes, bypassing detection mechanisms employed by security solutions such as EDRs, AVs, and sandboxes. This repository serves as a practical guide and educational resource to learn how PPID spoofing works, along with sample code for implementation. Disclaimer: This code is intended for Research purposes only. Any malicious use is strictly prohibited. Table of Contents Overview How It Works Code Walkthrough Installation Usage Contributing Disclaimer License How It Works PPID spoofing allows you to change the parent process of a newly created process, making it appear as though it is a child of an existing process. This technique can be used to bypass security detection that relies on parent-child relationships to identify suspicious processes. The process is implemented using the Windows API: Set Extended Startup Info: We initialize extended process attributes with EXTENDEDSTARTUPINFOPRESENT.