Query: Sigma YAML for windows / create_remote_thread
Matching passage: Sigma rule: Detects uncommon processes creating remote threads.. Logsource: windows / create_remote_thread. Rule: title: Rare Remote Thread Creation By Uncommon Source Image id: 02d1d718-dd13-41af-989d-ea85c7fab93f related: - id: 66d31e5f-52d6-40a4-9615-002d3789a119 type: derived status: test description: Detects uncommon processes creating remote threads. references: - Personal research, statistical analysis - https://lolbas-project.github.io author: Perez Diego (@darkquassar), oscd.community date: 2019-10-27 modified: 2025-12-08 tags: - attack.privilege-escalation - attack.stealth - attack.t1055 logsource: product: windows category: create_remote_thread detection: selection: SourceImage|endswith: - \bash.exe - \cscript.exe - \cvtres.exe - \defrag.exe - \dialer.exe - \dnx.exe - \esentutl.exe - \excel.exe - \expand.exe - \find.exe - \findstr.exe - \forfiles.exe - \gpupdate.exe - \hh.exe - \installutil.exe - \lync.exe - \makecab.exe - \mDNSResponder.exe - \monitoringhost.exe - \msbuild.exe - \mshta.exe - \mspaint.exe - \outlook.exe - \ping.exe - \provtool.exe - \python.exe - \regsvr32.exe - \robocopy.exe - \runonce.exe - \sapcimc.exe - \smartscreen.exe - \spoolsv.exe - \tstheme.exe - \userinit.exe - \vssadmin.exe - \vssvc.exe - \w3wp.exe - \winscp.exe - \winword.exe - \wmic.exe - \wscript.exe filter_main_conhost: SourceImage: - C:\Windows\System32\Defrag.exe - C:\Windows\System32\makecab.exe TargetImage: C:\Windows\System32\conhost.exe filter_main_provtol_svchost: SourceImage: C:\Windows\System32\provtool.exe TargetImage: C:\Windows\System32\svchost.exe filter_main_provtool_system: SourceImage: C:\Windows\System32\provtool.exe TargetImage: System filter_main_userinit: SourceImage: C:\Windows\System32\userinit.exe TargetImage: C:\Windows\explorer.exe filter_main_winword: SourceImage|endswith: \WINWORD.EXE TargetImage|startswith: - C:\Program Files (x86)\ - C:\Program Files\ filter_main_ms_office: SourceImage|startswith: - C:\Program Files\Microsoft Office\ - C:\Program Files (x86)\Microsoft Office\ TargetImage: System filter_optional_explorer_vmtools: SourceImage|endswith: \SysWOW64\explorer.exe TargetImage: - C:\Program Files (x86)\VMware\VMware Tools\vmtoolsd.exe - C:\Program Files\VMware\VMware Tools\vmtoolsd.exe condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - This rule is best put in testing first in order to create a baseline that reflects the data in your environment. level: high
Near-miss passage: Sigma rule: Detects a certain command line flag combination used by mpiexec.exe LOLBIN from HPC pack that can be used to execute any. Logsource: windows / process_creation. Rule: title: MpiExec Lolbin id: 729ce0ea-5d8f-4769-9762-e35de441586d status: test description: Detects a certain command line flag combination used by mpiexec.exe LOLBIN from HPC pack that can be used to execute any other binary references: - https://twitter.com/mrd0x/status/1465058133303246867 - https://learn.microsoft.com/en-us/powershell/high-performance-computing/mpiexec?view=hpc19-ps author: Florian Roth (Nextron Systems) date: 2022-01-11 modified: 2024-11-23 tags: - attack.execution - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_binary: - Image|endswith: \mpiexec.exe - Hashes|contains: IMPHASH=d8b52ef6aaa3a81501bdfff9dbb96217 selection_flags: CommandLine|contains: - ' /n 1 ' - ' -n 1 ' condition: all of selection* falsepositives: - Unknown level: high