Query: Sigma YAML for windows / create_remote_thread
Matching passage: Sigma rule: Detects uncommon target processes for remote thread creation. Logsource: windows / create_remote_thread. Rule: title: Remote Thread Creation In Uncommon Target Image id: a1a144b7-5c9b-4853-a559-2172be8d4a03 related: - id: f016c716-754a-467f-a39e-63c06f773987 type: obsolete status: test description: Detects uncommon target processes for remote thread creation references: - https://web.archive.org/web/20220319032520/https://blog.redbluepurple.io/offensive-research/bypassing-injection-detection author: Florian Roth (Nextron Systems) date: 2022-03-16 modified: 2025-07-04 tags: - attack.privilege-escalation - attack.stealth - attack.t1055.003 logsource: product: windows category: create_remote_thread detection: selection: TargetImage|endswith: - \calc.exe - \calculator.exe - \mspaint.exe - \notepad.exe - \ping.exe - \sethc.exe - \spoolsv.exe - \wordpad.exe - \write.exe filter_main_csrss: SourceImage: C:\Windows\System32\csrss.exe filter_main_notepad: SourceImage: - C:\Windows\System32\explorer.exe - C:\Windows\System32\OpenWith.exe TargetImage: C:\Windows\System32\notepad.exe filter_main_sethc: SourceImage: C:\Windows\System32\AtBroker.exe TargetImage: C:\Windows\System32\Sethc.exe filter_optional_aurora_1: StartFunction: EtwpNotificationThread filter_optional_aurora_2: SourceImage|contains: unknown process filter_optional_vmtoolsd: SourceImage: C:\Program Files\VMware\VMware Tools\vmtoolsd.exe StartFunction: GetCommandLineW TargetImage: - C:\Windows\System32\notepad.exe - C:\Windows\System32\spoolsv.exe filter_optional_xerox_pjems: SourceImage: C:\Program Files\Xerox\XeroxPrintExperience\CommonFiles\XeroxPrintJobEventManagerService.exe StartFunction: LoadLibraryW TargetImage: C:\Windows\System32\spoolsv.exe condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects when someone is adding or removing applications or folders from exploit guard "ProtectedFolders" or "AllowedAppl. Logsource: windows / windefend. Rule: title: Windows Defender Exploit Guard Tamper id: a3ab73f1-bd46-4319-8f06-4b20d0617886 status: test description: 'Detects when someone is adding or removing applications or folders from exploit guard "ProtectedFolders" or "AllowedApplications" ' references: - https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/windows-10-controlled-folder-access-event-search/ba-p/2326088 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-05 modified: 2022-12-06 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows service: windefend detection: allowed_apps_key: EventID: 5007 NewValue|contains: \Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access\AllowedApplications\ allowed_apps_path: NewValue|contains: - \Users\Public\ - \AppData\Local\Temp\ - \Desktop\ - \PerfLogs\ - \Windows\Temp\ protected_folders: EventID: 5007 OldValue|contains: \Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access\ProtectedFolders\ condition: all of allowed_apps* or protected_folders falsepositives: - Unlikely level: high