Parent PID Spoofing

Adversaries may specify a different parent process identifier when creating a Windows process, causing reported process lineage to differ from the actual caller. Windows supports this through extended process-creation attributes; the selected parent handle requires PROCESS_CREATE_PROCESS access, and inherited attributes can include the process token. Depending on the selected parent and access rights, this can hinder lineage-based detection or contribute to privilege escalation.