> Technique · Watchdog Process Respawning_

~/packetpursuit $ cat /intel/techniques/watchdog-process-respawning.md

typetechniqueconfidencehighcreated2026-08-13updated2026-08-13persistencedefense-evasionprocess-creationwatchdogbatch

Watchdog Process Respawning

A lightweight self-healing mechanism where a batch script or secondary process monitors the primary malware process and respawns it if it terminates. Often paired with persistence mechanisms to ensure the agent remains active even after crashes or user intervention.

Mechanism

  1. Primary agent writes its PID to a marker file (e.g., %TEMP%\vg_agent_running).
  2. A separate .bat script (vg_watchdog.bat) runs in a loop:
    • Reads the PID from the marker file.
    • Checks if the process is still alive via tasklist /fi "PID eq %_pid%".
    • If dead, respawns the agent with start /b "" "<path>".
    • Sleeps (timeout /t 5) and repeats.
  3. The watchdog itself may be launched via schtasks or a registry Run key.

Detection / Fingerprint

  • tasklist / find command chains in process-creation telemetry.
  • Repeated start /b launches of the same binary from a .bat file.
  • Marker files in %TEMP% containing a single PID integer.
  • Parent-child chains: cmd.exe → tasklist.exe → start.exe.

Observed In

  • valetgate — vg_watchdog.bat monitors %TEMP%\vg_agent_running and respawns via start /b. ^[/intel/analyses/61db1447817fd3b40db67ed261238e15f6338dc642a7a5a4bbf0c0ea5248594e.html]