osquery-defense-kit/detection/evasion/hidden-parent-pid.sql

-- Works well for revealing boopkit, so long as boopkit has a child process.
--
-- tags: periodic daemon
SELECT
  pp.*
FROM
  processes
  JOIN processes pp ON processes.parent = pp.pid
WHERE
  processes.parent NOT IN (
    SELECT
      pid
    FROM
      processes
  )
  AND processes.parent != 0;