PPID spoofing via PROC_THREAD_ATTRIBUTE_PARENT_PROCESS not detected

[akshat4703]

What should have matched?

A capability for spawning a process with a spoofed parent process (PPID spoofing).

What happened?

No relevant capability was detected.

Why this looks like a miss

The sample uses the classic PPID spoofing flow:

• InitializeProcThreadAttributeList
• UpdateProcThreadAttribute with PROC_THREAD_ATTRIBUTE_PARENT_PROCESS
• CreateProcess* with extended startup attributes

This is a common defense-evasion behavior and should be a strong candidate for rule coverage.

Suggested detection direction

Conservative initial rule requiring co-occurrence of:

1. attribute-list initialization APIs, and
2. parent-process attribute update, and
3. process creation API usage within the same function/scope.