Remote Thread Creation via Cmd.exe or PowerShell.exe (Windows)

title: Remote Thread Creation via Cmd.exe or PowerShell.exe (Windows)
id: 6a251c17-143c-4063-bdaf-c64d5f67c862
status: test
description: This rule flags cases where a remote thread is created by command shell processes such as cmd.exe, powershell.exe, or pwsh.exe. Remote thread creation is a common code-injection pattern used to run attacker-controlled code inside other processes. It relies on Windows remote thread creation telemetry, specifically the target image of cmd/powershell while excluding activity originating from common system binaries and Microsoft Defender (MsMpEng.exe).
references:
  - https://research.splunk.com/endpoint/10399c1e-f51e-11eb-b920-acde48001122/
  - https://www.binarydefense.com/resources/blog/icedid-gziploader-analysis/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/create_remote_thread/create_remote_thread_win_susp_target_shell_application.yml
author: Splunk Research Team, Huntrule Team
date: 2024-07-29
modified: 2025-07-04
tags:
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1055
  - detection.threat-hunting
logsource:
  product: windows
  category: create_remote_thread
detection:
  selection:
    TargetImage|endswith:
      - \cmd.exe
      - \powershell.exe
      - \pwsh.exe
  filter_main_system:
    SourceImage|startswith:
      - C:\Windows\System32\
      - C:\Windows\SysWOW64\
      - C:\Program Files (x86)\
      - C:\Program Files\
  filter_optional_defender:
    SourceImage|endswith: \MsMpEng.exe
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: a9d4d3fa-8fc0-41bc-80b1-30b9fda79d6f
    type: derived