Techniques › T1036.009 › AN1224
AN1224 Analytic 1224
macOS · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detects execution patterns where a child process is detached from its original parent, often showing up under 'launchd' (PID 1) with no parent lineage. These breakages in the process tree are indicative of evasive techniques using
daemon(), fork() or background execution flags.</p>- Detects
- T1036.009 Break Process Trees
- Part of
- DET0443 Detection Strategy for Masquerading via Breaking Process Trees
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| macos:unifiedlog | Process creation with parent PID of 1 (launchd) | DC0032 Process Creation |
| fs:fsusage | Detached process execution with no associated parent | DC0021 OS API Execution |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
AnomalyParentPID | Triggering PID used to flag abnormal child adoption (commonly PID 1) |
AllowedServices | Allowlist of background daemons legitimately using launchd as parent |
ProcessNameEntropy | Entropy score threshold for abnormal process names in detached state |