Detectionmediumtest

Remote Thread Creation In Uncommon Target Image

Detects uncommon target processes for remote thread creation

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Florian Roth (Nextron Systems)Created Wed Mar 16Updated Fri Jul 04a1a144b7-5c9b-4853-a559-2172be8d4a03windows

Log Source

WindowsRemote Thread Creation

ProductWindows← raw: windows

CategoryRemote Thread Creation← raw: create_remote_thread

Detection Logic

detection:
    selection:
        TargetImage|endswith:
            - '\calc.exe'
            - '\calculator.exe'
            - '\mspaint.exe'
            - '\notepad.exe'
            - '\ping.exe'
            - '\sethc.exe'
            - '\spoolsv.exe'
            - '\wordpad.exe'
            - '\write.exe'
    filter_main_csrss:
        SourceImage: 'C:\Windows\System32\csrss.exe'
    filter_main_notepad:
        SourceImage:
            - 'C:\Windows\System32\explorer.exe'
            - 'C:\Windows\System32\OpenWith.exe'
        TargetImage: 'C:\Windows\System32\notepad.exe'
    filter_main_sethc:
        SourceImage: 'C:\Windows\System32\AtBroker.exe'
        TargetImage: 'C:\Windows\System32\Sethc.exe'
    filter_optional_aurora_1:
        StartFunction: 'EtwpNotificationThread'
    filter_optional_aurora_2:
        SourceImage|contains: 'unknown process'
    filter_optional_vmtoolsd:
        SourceImage: 'C:\Program Files\VMware\VMware Tools\vmtoolsd.exe'
        StartFunction: 'GetCommandLineW'
        TargetImage:
            - 'C:\Windows\System32\notepad.exe'
            - 'C:\Windows\System32\spoolsv.exe'
    filter_optional_xerox_pjems:
        SourceImage: 'C:\Program Files\Xerox\XeroxPrintExperience\CommonFiles\XeroxPrintJobEventManagerService.exe'
        StartFunction: 'LoadLibraryW'
        TargetImage: 'C:\Windows\System32\spoolsv.exe'
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*