Query: write Sigma for Detects uncommon target processes for remote thread creation
Matching passage: Sigma rule: Detects uncommon target processes for remote thread creation. Logsource: windows / create_remote_thread. Rule: title: Remote Thread Creation In Uncommon Target Image id: a1a144b7-5c9b-4853-a559-2172be8d4a03 related: - id: f016c716-754a-467f-a39e-63c06f773987 type: obsolete status: test description: Detects uncommon target processes for remote thread creation references: - https://web.archive.org/web/20220319032520/https://blog.redbluepurple.io/offensive-research/bypassing-injection-detection author: Florian Roth (Nextron Systems) date: 2022-03-16 modified: 2025-07-04 tags: - attack.privilege-escalation - attack.stealth - attack.t1055.003 logsource: product: windows category: create_remote_thread detection: selection: TargetImage|endswith: - \calc.exe - \calculator.exe - \mspaint.exe - \notepad.exe - \ping.exe - \sethc.exe - \spoolsv.exe - \wordpad.exe - \write.exe filter_main_csrss: SourceImage: C:\Windows\System32\csrss.exe filter_main_notepad: SourceImage: - C:\Windows\System32\explorer.exe - C:\Windows\System32\OpenWith.exe TargetImage: C:\Windows\System32\notepad.exe filter_main_sethc: SourceImage: C:\Windows\System32\AtBroker.exe TargetImage: C:\Windows\System32\Sethc.exe filter_optional_aurora_1: StartFunction: EtwpNotificationThread filter_optional_aurora_2: SourceImage|contains: unknown process filter_optional_vmtoolsd: SourceImage: C:\Program Files\VMware\VMware Tools\vmtoolsd.exe StartFunction: GetCommandLineW TargetImage: - C:\Windows\System32\notepad.exe - C:\Windows\System32\spoolsv.exe filter_optional_xerox_pjems: SourceImage: C:\Program Files\Xerox\XeroxPrintExperience\CommonFiles\XeroxPrintJobEventManagerService.exe StartFunction: LoadLibraryW TargetImage: C:\Windows\System32\spoolsv.exe condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects execution of "odbcconf" with "INSTALLDRIVER" which installs a new ODBC driver. Attackers abuse this to install a. Logsource: windows / process_creation. Rule: title: Driver/DLL Installation Via Odbcconf.EXE id: 3f5491e2-8db8-496b-9e95-1029fce852d4 related: - id: cb0fe7c5-f3a3-484d-aa25-d350a7912729 type: similar status: test description: Detects execution of "odbcconf" with "INSTALLDRIVER" which installs a new ODBC driver. Attackers abuse this to install and run malicious DLLs. references: - https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/ - https://web.archive.org/web/20191023232753/https://twitter.com/Hexacorn/status/1187143326673330176 - https://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-22 tags: - attack.stealth - attack.t1218.008 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \odbcconf.exe - OriginalFileName: odbcconf.exe selection_cli: CommandLine|contains|all: - 'INSTALLDRIVER ' - .dll condition: all of selection_* falsepositives: - Legitimate driver DLLs being registered via "odbcconf" will generate false positives. Investigate the path of the DLL and its contents to determine if the action is authorized. level: medium