Windows Remote Thread Creation via Ttdinject.exe Proxy

ATT&CK techniques

Execution → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
- T1127Trusted Developer Utilities Proxy Execution
Persistence
Priv Esc
Defense Evasion
- T1127Trusted Developer Utilities Proxy Execution
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags remote thread creation events where the source image ends with '\\ttdinject.exe'. Using Ttdinject.exe as a proxy for remote thread injection can enable stealthy code execution in another process. It relies on Windows telemetry that records remote thread creation with the originating executable name.

Reporting behind it

Related detections9 linkedT1127 — drag to rearrange

Suspicious Code Compilation via Aspnet_compiler LOLBIN (via process_creation)

ArcSOC.exe Creates Suspicious Script/Executable Files on Windows

Suspicious Child Process of aspnet_compiler.exe on Windows

Suspicious aspnet_compiler.exe Execution from User or Temp Paths on Windows

Windows: Detect kavremover-related LOLBIN command-line usage

Windows node.exe Execution with -e/--eval and suspicious child process usage

Windows: Process creation involving VSIISExeLauncher.exe with -p and -a arguments

Windows Process Creation: Mftrace.exe Child Process Execution

Windows Process Creation: Remote.exe Execution

Windows Remote Thread Creation via Ttdinject.exe Proxy

Pivot detection · T1127 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-createremotethread-using-ttdinject-exe-as-proxy-c15e99a3

title: Windows Remote Thread Creation via Ttdinject.exe Proxy
id: 13d08f30-ab85-48b6-9577-61031cb21936
status: test
description: This rule flags remote thread creation events where the source image ends with '\\ttdinject.exe'. Using Ttdinject.exe as a proxy for remote thread injection can enable stealthy code execution in another process. It relies on Windows telemetry that records remote thread creation with the originating executable name.
references:
  - https://lolbas-project.github.io/lolbas/Binaries/Ttdinject/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/create_remote_thread/create_remote_thread_win_ttdinjec.yml
author: frack113, Huntrule Team
date: 2022-05-16
modified: 2022-06-02
tags:
  - attack.execution
  - attack.stealth
  - attack.t1127
logsource:
  product: windows
  category: create_remote_thread
detection:
  selection:
    SourceImage|endswith: \ttdinject.exe
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: c15e99a3-c474-48ab-b9a7-84549a7a9d16
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL