Potential Parent Process PID Spoofing via MalSecLogon

process where event.action == "start" and

   process.Ext.session_info.logon_type : "NewCredentials" and

   process.parent.Ext.real.pid > 0 and not process.Ext.token.integrity_level_name == "system" and

   /* dirs hosting interesting processes to spoof as parent process like Explorer.exe */
   process.parent.executable regex~ """(c:\\windows\\system32\\[a-z0-9\-\_\.]+\.exe
| c:\\windows\\syswow64\\[a-z0-9\-\_\.]+\.exe
| c:\\windows\\[a-z0-9\-\_\.]+\.exe)""" and

    /* common secLogon Clients running from trusted directories */
    not (process.parent.executable : "?:\\WINDOWS\\Explorer.EXE" and process.name : "rundll32.exe" and process.command_line : "*SHELL32.dll,RunAsNewUser_RunDLL*") and

    not (process.parent.executable : ("?:\\Windows\\System32\\runas.exe", "?:\\WINDOWS\\system32\\ShellRunas.exe", "?:\\Windows\\SysWOW64\\runas.exe") and
        process.parent.args_count >= 2) and

    not (process.parent.executable : "?:\\WINDOWS\\System32\\svchost.exe" and process.parent.args : "WdiServiceHost" and
         process.name : "rundll32.exe" and process.command_line : "*winethc.dll*ForceProxyDetectionOnNextRun*") and

    not (process.parent.executable : "?:\\Windows\\Sys*\\OneDriveSetup.exe" and process.parent.args : ("/thfirstsetup", "/uninstall") and
         process.pe.original_file_name in ("OneDrive.exe", "OneDriveSetup.exe") and
         process.code_signature.subject_name : "Microsoft *" and process.code_signature.trusted == true) and

    not (process.parent.executable : "?:\\Windows\\Sys*\\MsiExec.exe" and process.parent.args : "-Embedding") and

    not (process.parent.executable : "?:\\Windows\\System32\\consent.exe" and process.executable : "?:\\WINDOWS\\system32\\UserAccountControlSettings.exe") and

    /* RunAs execution via windows scripts */
    not process.parent.name : ("cscript.exe", "powershell.exe", "wscript.exe") and

    not process.parent.executable : ("?:\\windows\\system32\\ServerManager.exe", "?:\\Windows\\System32\\LogonUI.exe", "?:\\Windows\\System32\\dgagent\\dsagent.exe") and

    not (process.parent.executable : "?:\\Windows\\System32\\mmc.exe" and process.executable : "?:\\Windows\\system32\\gpupdate.exe") and

    not (process.pe.original_file_name == "OffCATcmd.exe" and process.code_signature.subject_name == "Microsoft Corporation" and
         process.code_signature.trusted == true and process.parent.executable : "?:\\Windows\\System32\\sdiagnhost.exe") and 
	 
    not (process.parent.name : "rundll32.exe" and process.parent.args : "?:\\WINDOWS\\Installer\\MSI*.tmp,zzzzInvokeManagedCustomActionOutOfProc") and

    not (process.code_signature.subject_name in ("Articulate Global, Inc.", "Samsung Electronics CO., LTD.", "SCHNEIDER ELECTRIC USA, INC.") and
         process.code_signature.trusted == true) and
    not process.executable : ("?:\\Windows\\System32\\SpecopsClient\\SecuredBrowserNet\\*.exe", "?:\\Windows\\System32\\DriverStore\\FileRepository\\*\\SamsungSystemSupportOSD.exe") and
    not (process.executable : "?:\\Windows\\SysWOW64\\OneDriveSetup.exe" and process.parent.executable : "?:\\Windows\\SysWOW64\\OneDriveSetup.exe") and

    not process.executable : "?:\\Windows\\System32\\DriverStore\\FileRepository\\*.exe" and

    not (process.code_signature.subject_name : ("TeamViewer*", "Schneider Electric") and process.code_signature.trusted == true) and

    not (process.pe.original_file_name : "VCPkgSrv.exe" and process.code_signature.trusted == true) and

    not process.executable : "?:\\Program Files (x86)\\Varian\\OCS\\*\\VMS.Varis.Vishnu.exe" and
    not (process.parent.executable : "C:\\Windows\\System32\\mmc.exe" and process.executable : "C:\\Windows\\System32\\mmc.exe" and process.args : "/server:*")