Query: Sigma YAML for windows / create_remote_thread
Matching passage: Sigma rule: Detects uncommon processes creating remote threads.. Logsource: windows / create_remote_thread. Rule: title: Remote Thread Creation By Uncommon Source Image id: 66d31e5f-52d6-40a4-9615-002d3789a119 related: - id: 02d1d718-dd13-41af-989d-ea85c7fab93f type: derived status: test description: Detects uncommon processes creating remote threads. references: - Personal research, statistical analysis - https://lolbas-project.github.io author: Perez Diego (@darkquassar), oscd.community date: 2019-10-27 modified: 2025-07-08 tags: - attack.privilege-escalation - attack.stealth - attack.t1055 logsource: product: windows category: create_remote_thread detection: selection: SourceImage|endswith: - \explorer.exe - \iexplore.exe - \msiexec.exe - \powerpnt.exe - \schtasks.exe - \winlogon.exe filter_main_winlogon_1: SourceImage: C:\Windows\System32\winlogon.exe TargetImage: - C:\Windows\System32\services.exe - C:\Windows\System32\wininit.exe - C:\Windows\System32\csrss.exe - C:\Windows\System32\LogonUI.exe - C:\Windows\System32\wlrmdr.exe - C:\Windows\System32\AtBroker.exe - C:\Windows\System32\dwm.exe - C:\Windows\System32\fontdrvhost.exe - C:\Windows\System32\userinit.exe filter_main_winlogon_2: SourceImage: C:\Windows\System32\winlogon.exe TargetParentProcessId: 4 filter_main_schtasks_conhost: SourceImage: - C:\Windows\System32\schtasks.exe - C:\Windows\SysWOW64\schtasks.exe TargetImage: C:\Windows\System32\conhost.exe filter_main_explorer: SourceImage: C:\Windows\explorer.exe TargetImage|startswith: - C:\Program Files (x86)\ - C:\Program Files\ - C:\Windows\System32\ - C:\Windows\SysWOW64\ filter_main_system: TargetImage: System filter_main_msiexec_1: SourceImage|endswith: \msiexec.exe TargetImage|contains: - \AppData\Local\ - C:\Program Files (x86)\ - C:\Program Files\ - C:\Windows\Microsoft.NET\Framework64\ filter_main_msiexec_2: SourceImage|endswith: \msiexec.exe TargetImage: - C:\Windows\System32\msiexec.exe - C:\Windows\SysWOW64\msiexec.exe filter_main_iexplore: SourceImage: C:\Program Files\Internet Explorer\iexplore.exe TargetImage: - C:\Program Files (x86)\Internet Explorer\iexplore.exe - C:\Windows\System32\rundll32.exe filter_main_powerpnt: SourceImage|endswith: \POWERPNT.EXE TargetImage|contains: - C:\Program Files\Microsoft Office\ - C:\Program Files (x86)\Microsoft Office\ filter_optional_aurora_smartconsole1: SourceImage: C:\Program Files\internet explorer\iexplore.exe SourceCommandLine|contains|all: - https:// - .checkpoint.com/documents/ - SmartConsole_OLH/ - default.htm#cshid= filter_optional_aurora_smartconsole2: SourceImage: C:\Program Files\internet
Near-miss passage: Sigma rule: Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the. Logsource: windows / process_creation. Rule: title: Potential Credential Dumping Attempt Using New NetworkProvider - CLI id: baef1ec6-2ca9-47a3-97cc-4cf2bda10b77 related: - id: 0442defa-b4a2-41c9-ae2c-ea7042fc4701 type: similar status: test description: Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it references: - https://learn.microsoft.com/en-us/troubleshoot/windows-client/setup-upgrade-and-drivers/network-provider-settings-removed-in-place-upgrade - https://github.com/gtworek/PSBits/tree/master/PasswordStealing/NPPSpy author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-23 modified: 2023-02-02 tags: - attack.credential-access - attack.t1003 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - \System\CurrentControlSet\Services\ - \NetworkProvider condition: selection falsepositives: - Other legitimate network providers used and not filtred in this rule level: high