create_remote_thread log source Sigma rules

Detects remote thread creation from CACTUSTORCH as described in references.

windows

Detects a potential remote threat creation with certain characteristics which are typical for Cobalt Strike beacons

windows

Detects password dumper activity by monitoring remote thread creation EventID 8 in combination with the lsass.exe process as TargetImage. The process in field Process is the malicious program. A single execution can lead to hundreds of events.

windows

Detects remote thread injection events based on action seen used by bumblebee

windows

Detects remote thread creation by PowerShell processes into "lsass.exe"

windows

Detects uncommon processes creating remote threads.

windows

Detects remote thread creation in "KeePass.exe" which could indicates potential password dumping activity

windows

Detects remote thread creation in the "mstsc.exe" process by a process located in a potentially suspicious location. This technique is often used by attackers in order to hook some APIs used by DLLs loaded by "mstsc.exe" during RDP authentications in order to steal credentials.

windows

Detects a remote thread creation of Ttdinject.exe used as proxy

windows

Detects potential use of CreateRemoteThread api and LoadLibrary function to inject DLL into a process

windows

Detects remote thread creation in command shell applications, such as "Cmd.EXE" and "PowerShell.EXE". It is a common technique used by malware, such as IcedID, to inject malicious code and execute it within legitimate processes.

windows

Detects uncommon processes creating remote threads.

windows

Detects uncommon target processes for remote thread creation

windows

Detects the creation of a remote thread from a Powershell process to another process

windows

Detects the creation of a remote thread from a Powershell process in an uncommon target process

windows