StrikeShark PPID Spoofing: cmd.exe spawned under svchost.exe via Cobalt Strike

Ibrahim Saud@tektrix

•updated Jun 28, 2026•1•0•3

This rule detects suspicious process spawning patterns where cmd.exe appears as a child of svchost.exe, which is indicative of PPID spoofing (often associated with Cobalt Strike's spawn-to and token impersonation techniques). It validates the relationship by checking if the grandparent process is the legitimate services.exe.