Remote Thread Creation Through PowerShell In Unusual Target (via create_remote_thread)

title: Remote Thread Creation Through PowerShell In Unusual Target (via create_remote_thread)
id: 47bb254c-9c45-5d78-aaeb-c1b0034986a8
status: stable
description: This rule detects the creation of a remote thread from a Powershell process in an uncommon target process
references:
    - https://attack.mitre.org/techniques/T1059/001/
    - https://attack.mitre.org/techniques/T1218/011/
    - https://www.fireeye.com/blog/threat-research/2018/06/bring-your-own-land-novel-red-teaming-technique.html
author: Huntrule Team
date: 2026-05-11
tags:
    - attack.execution
    - attack.stealth
    - attack.t1218.011
    - attack.t1059.001
logsource:
    product: windows
    category: create_remote_thread
detection:
    selection:
        SourceImage|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
        TargetImage|endswith:
            - '\rundll32.exe'
            - '\regsvr32.exe'
    condition: selection
falsepositives:
    - Unknown
level: medium