Windows Remote Thread Creation in cmd.exe or PowerShell.exe

Alert on remote thread creation where cmd.exe or PowerShell.exe is the initiating process, excluding common system and Defender sources.

FreeReviewedSigma · Medium · v5

Product: windows
Category: create_remote_thread
Author: Splunk Research Team (SigmaHQ), DRL 1.1
Published: 2024-07-29
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Priv Esc → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
- T1055Process Injection
Defense Evasion
- T1055Process Injection
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies remote thread creation where the target process is a Windows command shell application, specifically cmd.exe, powershell.exe, or pwsh.exe. Attackers may use remote thread techniques to run injected code within a legitimate process, blending malicious activity into normal system execution. The detection relies on telemetry for remote thread creation events and process image path details to match the target and to reduce noise from common system sources.

Reporting behind it

Related detections9 linkedT1055 — drag to rearrange

Suspicious Rundll32 Spawning Injection Target Process via Qakbot (via process_creation)

Malicious AddInProcess32 Network Beacon on PureRAT C2 Ports

Suspicious Payload Staging in ProgramData IntelDriver Folder (via file_event)

Possible DarkGate Process Injection via iTunesHelper Spawning vbc.exe

Suspicious PowerShell Shellcode Loader via Function Pointer Delegate

Suspicious Named Pipe Created by Kazuar Backdoor for Interprocess Command Channel

Suspicious SmallTiger Backdoor DLL Load via Image Load

Suspicious svchost Execution With Anomalous Arguments via DeedRAT (via process_creation)

Suspicious Sang Loader Execution with Install or PassUAC Arguments

Windows Remote Thread Creation in cmd.exe or PowerShell.exe

Pivot detection · T1055 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

remote-thread-creation-via-cmd-exe-or-powershell-exe-windows-a9d4d3fa

title: Windows Remote Thread Creation in cmd.exe or PowerShell.exe
id: 6a251c17-143c-4063-bdaf-c64d5f67c862
status: test
description: This rule identifies remote thread creation where the target process is a Windows command shell application, specifically cmd.exe, powershell.exe, or pwsh.exe. Attackers may use remote thread techniques to run injected code within a legitimate process, blending malicious activity into normal system execution. The detection relies on telemetry for remote thread creation events and process image path details to match the target and to reduce noise from common system sources.
references:
  - https://research.splunk.com/endpoint/10399c1e-f51e-11eb-b920-acde48001122/
  - https://www.binarydefense.com/resources/blog/icedid-gziploader-analysis/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/create_remote_thread/create_remote_thread_win_susp_target_shell_application.yml
author: Splunk Research Team, Huntrule Team
date: 2024-07-29
modified: 2025-07-04
tags:
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1055
  - detection.threat-hunting
logsource:
  product: windows
  category: create_remote_thread
detection:
  selection:
    TargetImage|endswith:
      - \cmd.exe
      - \powershell.exe
      - \pwsh.exe
  filter_main_system:
    SourceImage|startswith:
      - C:\Windows\System32\
      - C:\Windows\SysWOW64\
      - C:\Program Files (x86)\
      - C:\Program Files\
  filter_optional_defender:
    SourceImage|endswith: \MsMpEng.exe
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: a9d4d3fa-8fc0-41bc-80b1-30b9fda79d6f
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL