Activity timeline
T1134.004 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-10 with 4 reports, and 11 of the 11 threats were reported in the twelve months to 2026-11.
How adversaries use it
T1134.004 Parent PID Spoofing is catalogued by MITRE ATT&CK under the Privilege Escalation and Stealth (formerly Defense Evasion) tactics in the Enterprise matrix, as a sub-technique of T1134 Access Token Manipulation. Threadlinqs maps 11 of 3477 tracked threats (0.3%) to it; by severity that is 2 critical, 8 high, 1 medium.
Threats that use T1134.004 most often also use T1082 System Information Discovery (7 threats), T1027 Obfuscated Files or Information (6 threats), T1106 Native API (6 threats), T1140 Deobfuscate/Decode Files or Information (6 threats), T1071.001 Web Protocols (5 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
6 tracked threat actors appear in the threats that use T1134.004; the most frequent are MALFEX operator (2), APT38 (1), Andariel (1), Lazarus Group (1), LenAI (1).
Data sources
Telemetry that can reveal T1134.004, per MITRE ATT&CK.
- Process — OS API Execution, Process Creation, Process Metadata
Threat actors using it
Tracked threats
11 tracked threats use T1134.004.
- SloppyRAT: New ClickFix-Delivered Remote Access Trojan Supporting Ransomware Operationshigh
- Windows Minifilter Driver N-day Privilege Escalation - Public PoC (ALPC Write Primitive / PPID Spoofing…high
- Malicious AGENTS.md / CLAUDE.md Files in Downloads Folder Trick AI Coding Agents (Codex, Claude Code) Into…medium
- Operation FlashHole: Lazarus watering-hole and spear-phishing campaign abusing INISAFE CrossWeb EX against…high
- Apex Arena (REF8801) fake Web3 accelerator spreads CloudSyncD macOS backdoor and multi-stage Windows stealer…high
- 2CLoader: New Malware Loader Delivering Vidar, Remus and XWormhigh
- MALFEX: Malicious npm postinstall supply-chain campaign delivering Overlord RAT and movinlike stealerhigh
- CVE-2026-20817: Windows Error Reporting Service (WerSvc.dll) Local Privilege Escalation via ALPC Argument…high
- HoneyMyte (Mustang Panda) Upgrades CoolClient Backdoor with Kernel-Level Windows Rootkit (msagent.sys)high
- Windows Kernel CVE-2026-40369 — NtQuerySystemInformation ProbeForWrite Bypass Enables Arbitrary Kernel…critical
- Aeternum C2 Botnet — Polygon Blockchain Smart Contract C2, Takedown-Resistant Infrastructure, LenAI MaaScritical
Detection coverage
Threadlinqs maintains 12 detection rules mapped to T1134.004 (SPL 3, KQL 4, Sigma 5). Rule content is available to Blue tier accounts and above; this page shows counts only.
Parent technique
T1134 Access Token Manipulation — 99 tracked threats at the technique level.