{ "created_at": "2019-07-19T075721Z", "updated_at": "2019-07-19T075721Z", "deleted_at": null, "deleted": false, "id": 3830, "name": "1872579785_firefox.exe_incorrect_parent_process", "description": "Detect processes masquerading as legitimate Windows processes - ATT&CK T1204", "query": "SELECT name as bad_parent_child_name, pid bad_parent_child_pid FROM processes WHERE pid=(SELECT parent FROM processes WHERE parent!=(SELECT pid from processes where name='explorer.exe') AND LOWER(name)='firefox.exe') OR pid=(SELECT pid FROM processes WHERE parent!=(SELECT pid from processes where name='explorer.exe') AND LOWER(name)='firefox.exe');", "saved": true, "author_id": 1, "author_name": "sec", "packs": [ { "created_at": "2019-07-19T075719Z", "updated_at": "2019-07-19T075719Z", "deleted_at": null, "deleted": false, "id": 401, "name": "windows-incorrect_parent_process.conf", "description": "ATT&CK: T1173,T1086,T1204,T1183", "platform": "windows", "disabled": false } ] }