Knowledge is Power
BARE METAL CYBERKnowledge is Power

Sitewide Search

Search Bare Metal Cyber

Search courses, individual lessons, wiki entries, books, podcasts, magazine articles, Daily Cyber News, and Darwin.

MITRE D3FEND™ Learning Center

D3-PSA — Process Spawn Analysis

Analyzing spawn arguments or attributes of a process to detect processes that are unauthorized.

36Enterprise inferred
12ICS inferred
1Direct child
1Parent technique

Detect · D3FEND ontology 1.6.0 · Active

Open official technique ↗
Official D3FEND definition

Definition

Analyzing spawn arguments or attributes of a process to detect processes that are unauthorized.

Official D3FEND knowledge-base content

How it works

Process attributes are established when an operating system spawns a new process. These attributes are analyzed to look for the presence or absence of specific values or patterns.

Some attributes of interest are:

  • user
  • process name
  • image path
  • security content

Considerations

  • Attackers can spoof the parent process identifier (PPID), which could bypass this defense to allow execution of a malicious process from an arbitrary parent process.
  • Attackers could have legitimately compromised any of the process properties, such as the user, to make the execution appear legitimate.
  • Location: If the full image path is not checked, there could be a conflict with an executable that appears earlier due to resolution involving the system environment path/classpath variable.
  • Parsing issues: If the raw command from a shell is analyzed, rather than the actual function call, it is important to identify the actual command being run from its arguments. In Windows, services with unquoted file paths containing spaces will try to use the first token as the executable and the rest as arguments -- and shift tokens to the executable until a valid one is found.
  • Some [operating systems](/dao/artifact/d3f:OperatingSystem) can spawn processes without forking.
Bare Metal Cyber interpretation

Implementation perspective

Process Spawn Analysis should be treated as a technical defensive capability rather than a product checkbox. In practice, teams should define the protected scope, the conditions under which the technique acts, and the observable evidence that demonstrates the intended behavior. For this technique, likely engineering context includes Create Process, Process.

Use the technique to identify suspicious, unauthorized, or abnormal activity through observable evidence and repeatable analysis.

Questions to ask

  • Which events, states, or artifacts must be observed for the analysis to work?
  • What analytic logic, threshold, comparison, or signature turns observations into a finding?
  • How are expected false positives, blind spots, and environmental variations documented?
  • Who receives the result, and what action is expected when the technique produces a finding?

Evidence and validation

  • Telemetry and data-source configuration records
  • Analytic logic, thresholds, signatures, and version history
  • Test cases demonstrating expected positive and negative results
  • Alert, triage, escalation, and tuning records

Common failure patterns

  • Required telemetry is missing, delayed, or transformed in a way that invalidates the analysis.
  • The technique produces alerts without an accountable triage and response process.
  • Detection coverage is claimed from product deployment without testing the relevant analytic behavior.

This implementation perspective is original Bare Metal Cyber educational content. It does not replace the official D3FEND definition or establish that a specific product implements the technique.

Ontology hierarchy

Technique hierarchy

Top-level family

Parent techniques

Direct child techniques

D3FEND graph relationships

Artifacts and ontology entities

These relationships describe how D3FEND connects a defensive technique to artifacts or other ontology entities. They describe graph semantics, not a product certification.

Explicit technique relationships

analyzesCreate Process
analyzesProcess
Show inferred artifact relationship paths (3)
Process Lineage AnalysisanalyzesProcess
Process Spawn AnalysisanalyzesCreate Process
Process Spawn AnalysisanalyzesProcess
Inferred and experimental

Offensive-technique relationships

These relationships are generated from D3FEND graph paths and are explicitly experimental. They should be treated as hypotheses for defensive analysis—not as proof that the technique prevents, detects, or removes an offensive behavior.

ATT&CK Enterprise (36)
T1003.001LSASS MemoryCredential AccessT1003.002Security Account ManagerCredential AccessT1003.004LSA SecretsCredential AccessT1007System Service DiscoveryDiscoveryT1010Application Window DiscoveryDiscoveryT1016System Network Configuration DiscoveryDiscoveryT1018Remote System DiscoveryDiscoveryT1033System Owner/User DiscoveryDiscoveryT1047Windows Management InstrumentationExecutionT1053Scheduled Task/JobExecution, Persistence, Privilege EscalationT1053.005Scheduled TaskExecution, Persistence, Privilege EscalationT1055.004Asynchronous Procedure CallPrivilege Escalation, StealthT1055.013Process DoppelgängingPrivilege Escalation, StealthT1057Process DiscoveryDiscoveryT1082System Information DiscoveryDiscoveryT1124System Time DiscoveryDiscoveryT1134.004Parent PID SpoofingPrivilege Escalation, StealthT1140Deobfuscate/Decode Files or InformationStealthT1212Exploitation for Credential AccessCredential AccessT1218.001Compiled HTML FileStealthT1218.002Control PanelStealthT1218.003CMSTPStealthT1218.005MshtaStealthT1218.011Rundll32StealthT1220XSL Script ProcessingStealthT1505.001SQL Stored ProceduresPersistenceT1505.002Transport AgentPersistenceT1505.003Web ShellPersistenceT1546.007Netsh Helper DLLPersistence, Privilege EscalationT1546.009AppCert DLLsPersistence, Privilege EscalationT1546.010AppInit DLLsPersistence, Privilege EscalationT1548.002Bypass User Account ControlPrivilege EscalationT1550Use Alternate Authentication MaterialLateral MovementT1556Modify Authentication ProcessCredential Access, Defense Impairment, PersistenceT1562.001Disable or Modify ToolsStealthT1621Multi-Factor Authentication Request GenerationCredential Access
ATT&CK for ICS (12)
T0806Brute Force I/OImpair Process Control
T0813Denial of ControlImpact
T0814Denial of ServiceInhibit Response Function
T0819Exploit Public-Facing ApplicationInitial Access
T0821Modify controller TaskingExecution
T0823Graphical User InterfaceExecution
T0846Remote System DiscoveryDiscovery
T0863User ExecutionExecution
T0878Alarm SuppressionInhibit Response Function
T0888Remote System Information DiscoveryDiscovery
T0894System Binary Proxy ExecutionEvasion
T0895Autorun ImageExecution
Source record

Authoritative sources

Bare Metal Cyber is an independent educational publisher and is not affiliated with or endorsed by The MITRE Corporation. MITRE D3FEND™ and the D3FEND logo are trademarks of The MITRE Corporation. MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. Use of D3FEND source material is subject to the official Terms of Use.