huntrule

Windows CreateRemoteThread Using Ttdinject.exe as Proxy

Alerts on Windows create-remote-thread events initiated by Ttdinject.exe used as a proxy.

FreeUnreviewedSigmahighv1
title: Windows CreateRemoteThread Using Ttdinject.exe as Proxy
id: 13d08f30-ab85-48b6-9577-61031cb21936
status: test
description: This rule flags remote thread creation where the initiating process is Ttdinject.exe, indicating it is being used to proxy execution into another process. Creating remote threads is a common technique to run code in the context of a target process, which can help attackers evade normal process spawning and defenses. The detection relies on Windows telemetry for create-remote-thread activity and process image path matching for ttdinject.exe.
references:
  - https://lolbas-project.github.io/lolbas/Binaries/Ttdinject/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/create_remote_thread/create_remote_thread_win_ttdinjec.yml
author: frack113, Huntrule Team
date: 2022-05-16
modified: 2022-06-02
tags:
  - attack.execution
  - attack.stealth
  - attack.t1127
logsource:
  product: windows
  category: create_remote_thread
detection:
  selection:
    SourceImage|endswith: \ttdinject.exe
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: c15e99a3-c474-48ab-b9a7-84549a7a9d16
    type: derived

What it detects

This rule flags remote thread creation where the initiating process is Ttdinject.exe, indicating it is being used to proxy execution into another process. Creating remote threads is a common technique to run code in the context of a target process, which can help attackers evade normal process spawning and defenses. The detection relies on Windows telemetry for create-remote-thread activity and process image path matching for ttdinject.exe.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.