Sigma rule: Suspicious Remote Thread Target

Rule

Title

Suspicious Remote Thread Target

Status

deprecated

Level

medium

Author

Florian Roth (Nextron Systems)

Date

2022/08/25

Modified

2023/05/05

File

deprecated/windows/create_remote_thread_win_susp_remote_thread_target.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Offensive tradecraft is switching away from using APIs like "CreateRemoteThread", however, this is still largely observed in the wild.
This rule aims to detect suspicious processes (those we would not expect to behave in this way like winword.exe or outlook.exe) creating remote threads on other processes.
It is a generalistic rule, but it should have a low FP ratio due to the selected range of processes.

Log source

product

windows

category

create_remote_thread

Detection

selection:
    TargetImage|endswith:
        - '\spoolsv.exe'
        - '\notepad.exe'
filter:
    - SourceImage|endswith: '\csrss.exe'
    - SourceImage|contains: 'unknown process'
    - StartFunction: 'EtwpNotificationThread'
condition: selection and not filter

False positives (as the rule lists them)

• Unknown

References

• https://www.microsoft.com/security/blog/2022/08/24/looking-for-the-sliver-lining-hunting-for-emerging-command-and-control-frameworks/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/deprecated/windows/create_remote_thread_win_susp_remote_thread_target.yml