Query: detect Detects uncommon processes creating remote threads. in logs
Matching passage: Sigma rule: Detects uncommon processes creating remote threads.. Logsource: windows / create_remote_thread. Rule: title: Remote Thread Creation By Uncommon Source Image id: 66d31e5f-52d6-40a4-9615-002d3789a119 related: - id: 02d1d718-dd13-41af-989d-ea85c7fab93f type: derived status: test description: Detects uncommon processes creating remote threads. references: - Personal research, statistical analysis - https://lolbas-project.github.io author: Perez Diego (@darkquassar), oscd.community date: 2019-10-27 modified: 2025-07-08 tags: - attack.privilege-escalation - attack.stealth - attack.t1055 logsource: product: windows category: create_remote_thread detection: selection: SourceImage|endswith: - \explorer.exe - \iexplore.exe - \msiexec.exe - \powerpnt.exe - \schtasks.exe - \winlogon.exe filter_main_winlogon_1: SourceImage: C:\Windows\System32\winlogon.exe TargetImage: - C:\Windows\System32\services.exe - C:\Windows\System32\wininit.exe - C:\Windows\System32\csrss.exe - C:\Windows\System32\LogonUI.exe - C:\Windows\System32\wlrmdr.exe - C:\Windows\System32\AtBroker.exe - C:\Windows\System32\dwm.exe - C:\Windows\System32\fontdrvhost.exe - C:\Windows\System32\userinit.exe filter_main_winlogon_2: SourceImage: C:\Windows\System32\winlogon.exe TargetParentProcessId: 4 filter_main_schtasks_conhost: SourceImage: - C:\Windows\System32\schtasks.exe - C:\Windows\SysWOW64\schtasks.exe TargetImage: C:\Windows\System32\conhost.exe filter_main_explorer: SourceImage: C:\Windows\explorer.exe TargetImage|startswith: - C:\Program Files (x86)\ - C:\Program Files\ - C:\Windows\System32\ - C:\Windows\SysWOW64\ filter_main_system: TargetImage: System filter_main_msiexec_1: SourceImage|endswith: \msiexec.exe TargetImage|contains: - \AppData\Local\ - C:\Program Files (x86)\ - C:\Program Files\ - C:\Windows\Microsoft.NET\Framework64\ filter_main_msiexec_2: SourceImage|endswith: \msiexec.exe TargetImage: - C:\Windows\System32\msiexec.exe - C:\Windows\SysWOW64\msiexec.exe filter_main_iexplore: SourceImage: C:\Program Files\Internet Explorer\iexplore.exe TargetImage: - C:\Program Files (x86)\Internet Explorer\iexplore.exe - C:\Windows\System32\rundll32.exe filter_main_powerpnt: SourceImage|endswith: \POWERPNT.EXE TargetImage|contains: - C:\Program Files\Microsoft Office\ - C:\Program Files (x86)\Microsoft Office\ filter_optional_aurora_smartconsole1: SourceImage: C:\Program Files\internet explorer\iexplore.exe SourceCommandLine|contains|all: - https:// - .checkpoint.com/documents/ - SmartConsole_OLH/ - default.htm#cshid= filter_optional_aurora_smartconsole2: SourceImage: C:\Program Files\internet
Near-miss passage: Sigma rule: Identifies when a new cloudshell is created inside of Azure portal.. Logsource: azure / activitylogs. Rule: title: Azure New CloudShell Created id: 72af37e2-ec32-47dc-992b-bc288a2708cb status: test description: Identifies when a new cloudshell is created inside of Azure portal. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations author: Austin Songer date: 2021-09-21 modified: 2022-08-23 tags: - attack.execution - attack.t1059 logsource: product: azure service: activitylogs detection: selection: operationName: MICROSOFT.PORTAL/CONSOLES/WRITE condition: selection falsepositives: - A new cloudshell may be created by a system administrator. level: medium