# T1134.004 Parent PID Spoofing > As of 2026-11-01, T1134.004 (Parent PID Spoofing) appears in 11 tracked threats, first reported 2026-02-27 and most recently 2026-11-01, with linked actors including MALFEX operator, APT38, Andariel; it most often appears alongside T1082 (System Information Discovery). - **Tracked threats:** 11 (2 critical, 8 high, 1 medium) - **First seen:** 2026-02-27 - **Last seen:** 2026-11-01 - **Threat actors:** 6 - **Detection rules:** 12 (counts only; Blue tier and above) ## Key facts - **ID:** T1134.004 - **Framework:** MITRE ATT&CK - **Tactics:** Privilege Escalation, Stealth (formerly Defense Evasion) - **Matrix:** Enterprise - **Parent:** T1134 - **Data as of:** 2026-11-01 - **MITRE:** https://attack.mitre.org/techniques/T1134/004/ ## Activity timeline T1134.004 first appeared in tracked threats on 2026-02-27 and was most recently reported on 2026-11-01. The busiest month was 2026-10 with 4 reports, and 11 of the 11 threats were reported in the twelve months to 2026-11. ## How adversaries use it T1134.004 Parent PID Spoofing is catalogued by MITRE ATT&CK under the Privilege Escalation and Stealth (formerly Defense Evasion) tactics in the Enterprise matrix, as a sub-technique of [T1134 Access Token Manipulation](https://intel.threadlinqs.com/technique/T1134). Threadlinqs maps 11 of 3477 tracked threats (0.3%) to it; by severity that is 2 critical, 8 high, 1 medium. Threats that use T1134.004 most often also use [T1082 System Information Discovery](https://intel.threadlinqs.com/technique/T1082) (7 threats), [T1027 Obfuscated Files or Information](https://intel.threadlinqs.com/technique/T1027) (6 threats), [T1106 Native API](https://intel.threadlinqs.com/technique/T1106) (6 threats), [T1140 Deobfuscate/Decode Files or Information](https://intel.threadlinqs.com/technique/T1140) (6 threats), [T1071.001 Web Protocols](https://intel.threadlinqs.com/technique/T1071.001) (5 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. 6 tracked threat actors appear in the threats that use T1134.004; the most frequent are [MALFEX operator](https://intel.threadlinqs.com/actor/MALFEX%20operator) (2), [APT38](https://intel.threadlinqs.com/actor/APT38) (1), [Andariel](https://intel.threadlinqs.com/actor/Andariel) (1), [Lazarus Group](https://intel.threadlinqs.com/actor/Lazarus%20Group) (1), [LenAI](https://intel.threadlinqs.com/actor/LenAI) (1). ## Data sources Telemetry that can reveal T1134.004, per MITRE ATT&CK. - Process — OS API Execution, Process Creation, Process Metadata ## Threat actors using it - [MALFEX operator](https://intel.threadlinqs.com/actor/MALFEX%20operator) — 2 - [APT38](https://intel.threadlinqs.com/actor/APT38) — 1 - [Andariel](https://intel.threadlinqs.com/actor/Andariel) — 1 - [Lazarus Group](https://intel.threadlinqs.com/actor/Lazarus%20Group) — 1 - [LenAI](https://intel.threadlinqs.com/actor/LenAI) — 1 - [Mustang Panda](https://intel.threadlinqs.com/actor/Mustang%20Panda) — 1 ## Tracked threats 11 tracked threats use T1134.004. - [SloppyRAT: New ClickFix-Delivered Remote Access Trojan Supporting Ransomware Operations](https://intel.threadlinqs.com/threat/TL-2026-4997) — high — 2026-11-01 - [Windows Minifilter Driver N-day Privilege Escalation - Public PoC (ALPC Write Primitive / PPID Spoofing…](https://intel.threadlinqs.com/threat/TL-2026-4878) — high — 2026-10-31 - [Malicious AGENTS.md / CLAUDE.md Files in Downloads Folder Trick AI Coding Agents (Codex, Claude Code) Into…](https://intel.threadlinqs.com/threat/TL-2026-4436) — medium — 2026-10-26 - [Operation FlashHole: Lazarus watering-hole and spear-phishing campaign abusing INISAFE CrossWeb EX against…](https://intel.threadlinqs.com/threat/TL-2026-4000) — high — 2026-10-21 - [Apex Arena (REF8801) fake Web3 accelerator spreads CloudSyncD macOS backdoor and multi-stage Windows stealer…](https://intel.threadlinqs.com/threat/TL-2026-3389) — high — 2026-10-13 - [2CLoader: New Malware Loader Delivering Vidar, Remus and XWorm](https://intel.threadlinqs.com/threat/TL-2026-2819) — high — 2026-09-30 - [MALFEX: Malicious npm postinstall supply-chain campaign delivering Overlord RAT and movinlike stealer](https://intel.threadlinqs.com/threat/TL-2026-2801) — high — 2026-09-30 - [CVE-2026-20817: Windows Error Reporting Service (WerSvc.dll) Local Privilege Escalation via ALPC Argument…](https://intel.threadlinqs.com/threat/TL-2026-2479) — high — 2026-09-13 - [HoneyMyte (Mustang Panda) Upgrades CoolClient Backdoor with Kernel-Level Windows Rootkit (msagent.sys)](https://intel.threadlinqs.com/threat/TL-2026-2013) — high — 2026-08-14 - [Windows Kernel CVE-2026-40369 — NtQuerySystemInformation ProbeForWrite Bypass Enables Arbitrary Kernel…](https://intel.threadlinqs.com/threat/TL-2026-0604) — critical — 2026-05-27 - [Aeternum C2 Botnet — Polygon Blockchain Smart Contract C2, Takedown-Resistant Infrastructure, LenAI MaaS](https://intel.threadlinqs.com/threat/TL-2026-0151) — critical — 2026-02-27 ## Related CVEs CVEs referenced by the tracked threats that use T1134.004, most frequent first. - [CVE-2026-20817](https://intel.threadlinqs.com/cve/CVE-2026-20817) - [CVE-2026-40369](https://intel.threadlinqs.com/cve/CVE-2026-40369) ## Detection coverage Threadlinqs maintains 12 detection rules mapped to T1134.004 (SPL 3, KQL 4, Sigma 5). Rule content is available to Blue tier accounts and above; this page shows counts only. 12 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing ## Parent technique [T1134 Access Token Manipulation](https://intel.threadlinqs.com/technique/T1134) — 99 tracked threats at the technique level. ## Links - Canonical page: https://intel.threadlinqs.com/technique/T1134.004 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)