Windows Remote Thread Creation in cmd.exe or PowerShell.exe
Alert on remote thread creation where cmd.exe or PowerShell.exe is the initiating process, excluding common system and Defender sources.
- Product
- windows
- Category
- create_remote_thread
- Author
- Splunk Research Team (SigmaHQ), DRL 1.1
- Published
- 2024-07-29
- Updated
- 2026-07-31
ATT&CK techniques
Priv Esc → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies remote thread creation where the target process is a Windows command shell application, specifically cmd.exe, powershell.exe, or pwsh.exe. Attackers may use remote thread techniques to run injected code within a legitimate process, blending malicious activity into normal system execution. The detection relies on telemetry for remote thread creation events and process image path details to match the target and to reduce noise from common system sources.
Reporting behind it
- research.splunk.comhttps://research.splunk.com/endpoint/10399c1e-f51e-11eb-b920-acde48001122/
- binarydefense.comhttps://www.binarydefense.com/resources/blog/icedid-gziploader-analysis/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/create_remote_thread/create_remote_thread_win_susp_target_shell_application.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Remote Thread Creation in cmd.exe or PowerShell.exe
id: 6a251c17-143c-4063-bdaf-c64d5f67c862
status: test
description: This rule identifies remote thread creation where the target process is a Windows command shell application, specifically cmd.exe, powershell.exe, or pwsh.exe. Attackers may use remote thread techniques to run injected code within a legitimate process, blending malicious activity into normal system execution. The detection relies on telemetry for remote thread creation events and process image path details to match the target and to reduce noise from common system sources.
references:
- https://research.splunk.com/endpoint/10399c1e-f51e-11eb-b920-acde48001122/
- https://www.binarydefense.com/resources/blog/icedid-gziploader-analysis/
- https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/create_remote_thread/create_remote_thread_win_susp_target_shell_application.yml
author: Splunk Research Team, Huntrule Team
date: 2024-07-29
modified: 2025-07-04
tags:
- attack.privilege-escalation
- attack.stealth
- attack.t1055
- detection.threat-hunting
logsource:
product: windows
category: create_remote_thread
detection:
selection:
TargetImage|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
filter_main_system:
SourceImage|startswith:
- C:\Windows\System32\
- C:\Windows\SysWOW64\
- C:\Program Files (x86)\
- C:\Program Files\
filter_optional_defender:
SourceImage|endswith: \MsMpEng.exe
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: a9d4d3fa-8fc0-41bc-80b1-30b9fda79d6f
type: derived