Windows CreateRemoteThread with LoadLibraryA likely DLL injection
Alerts on CreateRemoteThread starting LoadLibraryA from kernel32.dll, consistent with DLL injection attempts.
FreeReviewedSigma · Medium · v5
- Product
- windows
- Category
- create_remote_thread
- Author
- Roberto Rodriguez @Cyb3rWard0g (SigmaHQ), DRL 1.1
- Published
- 2019-08-11
- Updated
- 2026-07-31
ATT&CK techniques
Priv Esc → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags API activity where a remote thread is started with a thread entry point in kernel32.dll that calls LoadLibraryA. Attackers use this pattern to load a DLL into another process, enabling code execution and common injection techniques. Telemetry relies on Windows event data that records the remote thread start module and function name.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-createremotethread-with-loadlibrarya-for-dll-injection-052ec6f6
title: Windows CreateRemoteThread with LoadLibraryA likely DLL injection
id: 5e386a41-ceaf-4d2d-bc6e-b362ae9b125d
status: test
description: This rule flags API activity where a remote thread is started with a thread entry point in kernel32.dll that calls LoadLibraryA. Attackers use this pattern to load a DLL into another process, enabling code execution and common injection techniques. Telemetry relies on Windows event data that records the remote thread start module and function name.
references:
- https://threathunterplaybook.com/hunts/windows/180719-DLLProcessInjectionCreateRemoteThread/notebook.html
- https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/create_remote_thread/create_remote_thread_win_loadlibrary.yml
author: Roberto Rodriguez @Cyb3rWard0g, Huntrule Team
date: 2019-08-11
modified: 2024-01-22
tags:
- attack.privilege-escalation
- attack.stealth
- attack.t1055.001
- detection.threat-hunting
logsource:
product: windows
category: create_remote_thread
detection:
selection:
StartModule|endswith: \kernel32.dll
StartFunction: LoadLibraryA
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 052ec6f6-1adc-41e6-907a-f1c813478bee
type: derived