Skip to content
/ Foster Public

Demo for spawning processes under a specified parent PID.

Notifications You must be signed in to change notification settings

0d-gg/Foster

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

9 Commits
 
 
 
 
 
 
 
 

Repository files navigation

Foster

Demo for spawning processes under a specified parent PID in C#. Based heavily on the work by Didier Stevens: https://blog.didierstevens.com/2017/03/20/that-is-not-my-child-process/

If you have permissions, you can start a new process as a child process of another process. This can be valuable for evading threat-hunting mechanisms that check for suspicious parent-child relationships such as cmd.exe being a child of an unknown process.

Command syntax

example commands

Spawning notepad.exe under explorer.

example commands

Spawning notepad.exe under lsass.exe (requires eleveated privs).

example commands

About

Demo for spawning processes under a specified parent PID.

Topics

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages