Windows CreateRemoteThread with LoadLibraryA for DLL Injection

Alerts on CreateRemoteThread starting LoadLibraryA from kernel32.dll, consistent with DLL injection attempts.

FreeUnreviewedSigmamediumv1

windows-createremotethread-with-loadlibrarya-for-dll-injection-052ec6f6

title: Windows CreateRemoteThread with LoadLibraryA for DLL Injection
id: 5e386a41-ceaf-4d2d-bc6e-b362ae9b125d
status: test
description: This rule flags API usage patterns where a remote thread is started with StartFunction set to LoadLibraryA and StartModule ending in kernel32.dll. Attackers commonly use this combination to load a DLL inside another process, enabling stealthy code execution. The detection relies on Windows telemetry capturing CreateRemoteThread-related parameters, specifically the referenced module and function names.
references:
  - https://threathunterplaybook.com/hunts/windows/180719-DLLProcessInjectionCreateRemoteThread/notebook.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/create_remote_thread/create_remote_thread_win_loadlibrary.yml
author: Roberto Rodriguez @Cyb3rWard0g, Huntrule Team
date: 2019-08-11
modified: 2024-01-22
tags:
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1055.001
  - detection.threat-hunting
logsource:
  product: windows
  category: create_remote_thread
detection:
  selection:
    StartModule|endswith: \kernel32.dll
    StartFunction: LoadLibraryA
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 052ec6f6-1adc-41e6-907a-f1c813478bee
    type: derived

What it detects

This rule flags API usage patterns where a remote thread is started with StartFunction set to LoadLibraryA and StartModule ending in kernel32.dll. Attackers commonly use this combination to load a DLL inside another process, enabling stealthy code execution. The detection relies on Windows telemetry capturing CreateRemoteThread-related parameters, specifically the referenced module and function names.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.