Windows Remote Thread Creation in cmd.exe or PowerShell.exe

Alert on remote thread creation where cmd.exe or PowerShell.exe is the initiating process, excluding common system and Defender sources.

FreeReviewedSigma · Medium · v5

Product: windows
Category: create_remote_thread
Author: Splunk Research Team (SigmaHQ), DRL 1.1
Published: 2024-07-29
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Priv Esc → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
- T1055Process Injection
Defense Evasion
- T1055Process Injection
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies remote thread creation where the target process is a Windows command shell application, specifically cmd.exe, powershell.exe, or pwsh.exe. Attackers may use remote thread techniques to run injected code within a legitimate process, blending malicious activity into normal system execution. The detection relies on telemetry for remote thread creation events and process image path details to match the target and to reduce noise from common system sources.

Reporting behind it

Related detections9 linkedT1055 — drag to rearrange

Suspicious Office Application Spawning Script Or Shell Interpreter

Suspicious Network Connection From wabmig.exe (Turian Injection)

Suspicious Outbound Network Connection from Explorer Process

Suspicious AppLaunch.exe Spawned As Injection Target (via process_creation)

Suspicious BugSleep Marker File in Public Directory

Suspicious CRAT Injection Named Pipe ChromeUpdatePipe (via pipe_created)

AsyncRAT Injector libPK.dll Written to Public Folder (via file_event)

FlawedGrace spawning threat injection target

In-Memory Ramnit Process Injection Target Spawned by WmiPrvSE in drIBAN Fraud Operation (via process_creation)

Windows Remote Thread Creation in cmd.exe or PowerShell.exe

Pivot detection · T1055 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

remote-thread-creation-via-cmd-exe-or-powershell-exe-windows-a9d4d3fa

title: Windows Remote Thread Creation in cmd.exe or PowerShell.exe
id: 6a251c17-143c-4063-bdaf-c64d5f67c862
status: test
description: This rule identifies remote thread creation where the target process is a Windows command shell application, specifically cmd.exe, powershell.exe, or pwsh.exe. Attackers may use remote thread techniques to run injected code within a legitimate process, blending malicious activity into normal system execution. The detection relies on telemetry for remote thread creation events and process image path details to match the target and to reduce noise from common system sources.
references:
  - https://research.splunk.com/endpoint/10399c1e-f51e-11eb-b920-acde48001122/
  - https://www.binarydefense.com/resources/blog/icedid-gziploader-analysis/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/create_remote_thread/create_remote_thread_win_susp_target_shell_application.yml
author: Splunk Research Team, Huntrule Team
date: 2024-07-29
modified: 2025-07-04
tags:
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1055
  - detection.threat-hunting
logsource:
  product: windows
  category: create_remote_thread
detection:
  selection:
    TargetImage|endswith:
      - \cmd.exe
      - \powershell.exe
      - \pwsh.exe
  filter_main_system:
    SourceImage|startswith:
      - C:\Windows\System32\
      - C:\Windows\SysWOW64\
      - C:\Program Files (x86)\
      - C:\Program Files\
  filter_optional_defender:
    SourceImage|endswith: \MsMpEng.exe
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: a9d4d3fa-8fc0-41bc-80b1-30b9fda79d6f
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL