feat: strengthen spoof parent PID rule with full PPID spoofing flow

[itxsamad1]

Summary

• Strengthen spoof parent PID detection rule with full PPID spoofing flow coverage.

Fixes #1145

Test plan

• Validate rule against representative samples.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[williballenthin]

please provide a test sample that demonstrates this behavior

[itxsamad1]

Hi @williballenthin — added a minimal test sample that demonstrates the full PPID spoofing flow matched by this rule.

Test sample

• SHA256: 7fc295b013cf773eb71e3de24944a7ca1e876846137cb6c6a758a26bbc1ce4f5
• Function offset: 0x140001000 (spoof_parent_pid)
• capa-testfiles PR: Add PPID spoof PoC test sample for capa-rules #1167 capa-testfiles#315

The PoC is a small C program that:

1. Opens explorer.exe as the parent process handle
2. Calls InitializeProcThreadAttributeList
3. Calls UpdateProcThreadAttribute with PROC_THREAD_ATTRIBUTE_PARENT_PROCESS (0x20000)
4. Calls CreateProcessW with EXTENDED_STARTUPINFO_PRESENT

capa v9.4.0 verification

capa -r <updated-rules> 7fc295b013cf773eb71e3de24944a7ca1e876846137cb6c6a758a26bbc1ce4f5.exe_

Capability                              Namespace
spoof parent PID                        anti-analysis/anti-forensic

ATT&CK: Defense Evasion::Access Token Manipulation::Parent PID Spoofing [T1134.004]

The rule examples field has been updated to 7fc295b013cf773eb71e3de24944a7ca1e876846137cb6c6a758a26bbc1ce4f5:0x140001000 on this branch.

[itxsamad1]

Thanks @williballenthin — added a minimal test sample that demonstrates the full PPID spoofing flow.

Test sample

• capa-testfiles PR: Add PPID spoof PoC test sample for capa-rules #1167 capa-testfiles#315
• SHA256: 6538c46d9632ec5f7407de7918723c048e12e1f6883d1029d136da4a56d3c23a
• Example offset: 0x140001450 (function containing the match)

The sample is a small C PoC that calls:

1. InitializeProcThreadAttributeList
2. UpdateProcThreadAttribute with PROC_THREAD_ATTRIBUTE_PARENT_PROCESS (0x20000)
3. CreateProcessA with EXTENDED_STARTUPINFO_PRESENT

capa verification (v9.4.0)

capa ppid_spoof.exe -r spoof-parent-pid.yml

Capability                       Namespace
spoof parent PID                 anti-analysis/anti-forensic

ATT&CK: Defense Evasion::Access Token Manipulation::Parent PID Spoofing [T1134.004]

Verbose output shows the match at 0x140001450.

Updated spoof-parent-pid.yml examples on this branch with the new hash/offset. The prior example (2ebadd04...) is retained for the narrower legacy match.

[itxsamad1]

Test sample demonstrating full PPID spoof flow

Per @williballenthin request, here is a minimal Windows PE that exercises the complete parent-PID spoofing API sequence in one function (spoof_parent_and_spawn @ 0x140001760):

Item	Value
SHA256	bfe31574ede658dcd647bcbcceee17cf10605a66fe8be366da94f90f4ed516a3
capa-testfiles name	bfe31574ede658dcd647bcbcceee17cf10605a66fe8be366da94f90f4ed516a3.exe_
Rule example	bfe31574ede658dcd647bcbcceee17cf10605a66fe8be366da94f90f4ed516a3:0x140001760

capa-testfiles PR

Sample uploaded in: mandiant/capa-testfiles#315

capa verification (capa v9.4.0)

capa.exe -r <capa-rules> -vv bfe31574ede658dcd647bcbcceee17cf10605a66fe8be366da94f90f4ed516a3.exe_
sha256: bfe31574ede658dcd647bcbcceee17cf10605a66fe8be366da94f90f4ed516a3

spoof parent PID (2 matches)
namespace   anti-analysis/anti-forensic
function @ 0x140001760
  and:
    api: InitializeProcThreadAttributeList @ 0x1400018A8, 0x1400018EE
    api: UpdateProcThreadAttribute @ 0x140001923
    number: 0x20000 = PROC_THREAD_ATTRIBUTE_PARENT_PROCESS @ 0x14000191D
    or:
      api: CreateProcess @ 0x140001994
      api: CreateProcessW @ 0x140001994

The PoC uses InitializeProcThreadAttributeList, UpdateProcThreadAttribute with PROC_THREAD_ATTRIBUTE_PARENT_PROCESS (0x20000), and CreateProcessW with EXTENDED_STARTUPINFO_PRESENT (spawns notepad.exe suspended with explorer.exe as spoofed parent, then terminates the child).

capa-rules update

spoof-parent-pid.yml examples updated on branch enhance/spoof-parent-pid-detection with the verified hash/offset above. python scripts/lint.py --thorough -t "spoof parent PID" passes with the sample.

Related: #1145

[mike-hunhoff]

@itxsamad1 please explain why these changes are needed to strengthen the rule. Do you have examples of false positives?