Sigma rule: Rare Remote Thread Creation By Uncommon Source Image

Rule

Title

Rare Remote Thread Creation By Uncommon Source Image

Status

test

Level

high

Author

Perez Diego (@darkquassar), oscd.community

Date

2019-10-27

Modified

2025-12-08

File

rules/windows/create_remote_thread/create_remote_thread_win_susp_relevant_source_image.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects uncommon processes creating remote threads.

Log source

product

windows

category

create_remote_thread

Detection

selection:
    SourceImage|endswith:
        - '\bash.exe'
        - '\cscript.exe'
        - '\cvtres.exe'
        - '\defrag.exe'
        - '\dialer.exe'
        - '\dnx.exe'
        - '\esentutl.exe'
        - '\excel.exe'
        - '\expand.exe'
        - '\find.exe'
        - '\findstr.exe'
        - '\forfiles.exe'
        - '\gpupdate.exe'
        - '\hh.exe'
        - '\installutil.exe'
        - '\lync.exe'
        - '\makecab.exe'
        - '\mDNSResponder.exe'
        - '\monitoringhost.exe' # Loads .NET CLR by default and thus a favorite for process injection for .NET in-memory offensive tools.
        - '\msbuild.exe'
        - '\mshta.exe'
        - '\mspaint.exe'
        - '\outlook.exe'
        - '\ping.exe'
        - '\provtool.exe'
        - '\python.exe'
        - '\regsvr32.exe'
        - '\robocopy.exe'
        - '\runonce.exe'
        - '\sapcimc.exe'
        - '\smartscreen.exe'
        - '\spoolsv.exe'
        - '\tstheme.exe'
        - '\userinit.exe'
        - '\vssadmin.exe'
        - '\vssvc.exe'
        - '\w3wp.exe'
        - '\winscp.exe'
        - '\winword.exe'
        - '\wmic.exe'
        - '\wscript.exe'
filter_main_conhost:
    SourceImage:
        - 'C:\Windows\System32\Defrag.exe'
        - 'C:\Windows\System32\makecab.exe'
    TargetImage: 'C:\Windows\System32\conhost.exe'
filter_main_provtol_svchost:
    SourceImage: 'C:\Windows\System32\provtool.exe'
    TargetImage: 'C:\Windows\System32\svchost.exe'
filter_main_provtool_system:
    SourceImage: 'C:\Windows\System32\provtool.exe'
    TargetImage: 'System'
filter_main_userinit:
    SourceImage: 'C:\Windows\System32\userinit.exe'
    TargetImage: 'C:\Windows\explorer.exe'
filter_main_winword:
    SourceImage|endswith: '\WINWORD.EXE'
    TargetImage|startswith:
        - 'C:\Program Files (x86)\' # C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        - 'C:\Program Files\' # C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\AI\ai.exe
filter_main_ms_office:
    # Raised by following issue: https://github.com/SigmaHQ/sigma/issues/5529
    SourceImage|startswith:
        - 'C:\Program Files\Microsoft Office\'
        - 'C:\Program Files (x86)\Microsoft Office\'
    TargetImage: 'System'
filter_optional_explorer_vmtools:
    SourceImage|endswith: '\SysWOW64\explorer.exe'
    TargetImage:
        - 'C:\Program Files (x86)\VMware\VMware Tools\vmtoolsd.exe'
        - 'C:\Program Files\VMware\VMware Tools\vmtoolsd.exe'
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*

False positives (as the rule lists them)

• This rule is best put in testing first in order to create a baseline that reflects the data in your environment.

Tags

• attack.privilege-escalation
• attack.stealth
• attack.t1055

MITRE ATT&CK ids this rule names

• T1055

Related rules

• 66d31e5f-52d6-40a4-9615-002d3789a119 (derived)

References

• Personal research, statistical analysis
• https://lolbas-project.github.io

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/create_remote_thread/create_remote_thread_win_susp_relevant_source_image.yml