Break Process Trees is ATT&CK T1036.009. It is a Stealth technique for Linux and macOS. The goal is to evade analysis that relies on parent and child process relationships by changing the parent process ID of the malware.
How attackers use it
MITRE explains that if endpoint protection uses the parent-child relationship for detection, breaking it can mean the malicious behavior is no longer linked to earlier process activity. It adds an important caveat: on Unix-like systems, administrators break process trees all the time when they run software through scripts and programs. The technique is a normal pattern used for abnormal reasons.
On Linux, MITRE describes an adversary running a payload with no arguments, calling fork twice, then letting the original parent exit. The grandchild is left with no parent and is adopted by the init process, PID 1. Another approach is the daemon system call, which detaches from the current parent and runs in the background.
Procedure examples on the page include BPFDoor, which forks itself and lets the parent terminate so the child is inherited by init. The page also notes Shai-Hulud, which has an original install process exit cleanly to give the user the illusion that the service installed normally.
Click through it at your own pace, or open it full screen.
How to detect it
The MITRE analytics look for a process whose parent exits quickly after process creation, or that is re-parented to PID 1. On macOS the equivalent shows up as a child detached from its parent and visible under launchd with no lineage. Look for use of daemon, fork or background flags in the activity around it.
Since benign daemons do the same thing, the signal comes from context: what the process is, where it was run from, who started it, and what it connects to. Keep process creation events with the original parent recorded at the moment of creation, so you can rebuild the tree even after the parent has gone.
A read-only way to list processes that are currently children of PID 1 on Linux:
ps -eo pid,ppid,user,args | awk '$2==1'
Expect system services in that list. Look for ones that you cannot explain.
How to reduce the risk
MITRE's page for this sub-technique lists no dedicated mitigations. The defensive answer is to record parentage at creation time, not rely on live process trees, and to review new long-running processes by owner, path and network behavior. If the code arrives through a package install, review what the install step runs. The free in-browser dependency scan at gold.safeguard.sh/scan checks up to 100 dependencies, with no login and no upload of your file.
