ParentProcess

How it works

Normally, a user-mode process is executed by double-clicking on a file icon. If the process is executed this way, its parent process will be the shell process (“explorer.exe”, "cmd.exe", "powershell.exe").

The main idea of the two following method is:

• Compare the PID of parent process with the pid of “explorer.exe”, "cmd.exe", "powershell.exe"
• Check the parent process signature (it can prevent fake names in parent process)
• Check full file path and file name are same

Reference

Anti-Debug Tricks