win:sysmon 8
CreateRemoteThread
The CreateRemoteThread event detects when a process creates a thread in another process.
- Log source
- Sysmon
- Host type
- Windows (workstation, member server, domain controller)
- How to enable
- Install Sysmon with a configuration that includes the matching rule group; see sysmon-modular for an ATT&CK-mapped configuration.
- Tier, host type
- Minimum
- Techniques
- 10
- Rules depending on it
- Splunk 6, Sigma 15, Elastic 1
Why this tier
By role
| Role | Tier | Basis |
|---|---|---|
| Windows workstation | Minimum | |
| Windows member server | Minimum | |
| Windows domain controller | Minimum | |
| Windows web server (IIS), internet-facing | Minimum |
Techniques it helps detect
Rules that depend on it
Splunk 6
Sigma 15
- CreateRemoteThread API and LoadLibrary by Roberto Rodriguez @Cyb3rWard0g
- HackTool - CACTUSTORCH Remote Thread Creation by @SBousseaden (detection), Thomas Patzke (rule)
- HackTool - Potential CobaltStrike Process Injection by Olaf Hartong, Florian Roth (Nextron Systems), Aleksey Potapov, oscd.community
- Password Dumper Remote Thread in LSASS by Thomas Patzke
- Potential Bumblebee Remote Thread Creation by Nasreddine Bencherchali (Nextron Systems)
- Potential Credential Dumping Attempt Via PowerShell Remote Thread by oscd.community, Natalia Shornikova
- Rare Remote Thread Creation By Uncommon Source Image by Perez Diego (@darkquassar), oscd.community
- Remote Thread Created In KeePass.EXE by Timon Hackenjos
- Remote Thread Created In Shell Application by Splunk Research Team
- Remote Thread Creation By Uncommon Source Image by Perez Diego (@darkquassar), oscd.community
- Remote Thread Creation In Mstsc.Exe From Suspicious Location by Nasreddine Bencherchali (Nextron Systems)
- Remote Thread Creation In Uncommon Target Image by Florian Roth (Nextron Systems)
- Remote Thread Creation Ttdinject.exe Proxy by frack113
- Remote Thread Creation Via PowerShell by Nikita Nazarov, oscd.community
- Remote Thread Creation Via PowerShell In Uncommon Target by Florian Roth (Nextron Systems)
EDR events that stand in for it
Full: the sensor event carries what this event carries. Partial: the sensor reports a subset, so it does not replace the event.
| Product | Sensor event | Fidelity | Basis |
|---|---|---|---|
| Microsoft Defender for Endpoint device tables | DeviceEvents | Partial | our analysis: CreateRemoteThreadApiCall, QueueUserApcRemoteApiCall and SetThreadContextRemoteApiCall ActionTypes in DeviceEvents (named in Sentinel rules); not every remote thread is reported |
| Elastic Defend endpoint events | api | Partial | our analysis: Elastic Defend api dataset reports selected injection-related API calls |