huntrule

Windows Remote Thread Injection Indicators via Process StartAddress Suffixes

Flags Windows CreateRemoteThread events with StartAddress suffixes 0B80, 0C7C, or 0C88.

FreeReviewedSigma · High · v2
Product
windows
Category
create_remote_thread
Author
Olaf Hartong, Florian Roth (Nextron Systems), Aleksey Potapov, oscd.community (SigmaHQ), DRL 1.1
Published
2018-11-30
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Priv Esc → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags creation of a remote thread where the StartAddress ends with specific hexadecimal suffixes associated with Cobalt Strike beacon behavior. Attackers may use remote thread injection to execute payload code within another process, improving stealth and persistence. The detection relies on Windows telemetry for remote thread creation events and the StartAddress value suffix matching those patterns.

Reporting behind it

Related detections9 linkedT1055.001 — drag to rearrange
Suspicious Process Injection via mavinject INJECTRUNNING
In-Memory Process Injection via Mavinject INJECTRUNNING (via process_creation)
Suspicious Service Reconfiguration of SessionEnv or IKEEXT for DLL Injection by EAGERBEE
Windows Process Creation: Renamed Mavinject32/64.EXE Execution
Windows Process Injection via Mavinject Using INJECTRUNNING Flag
Windows Process Execution and DLL Injection via Tracker.exe
Windows TAIDOOR RAT DLL Load via rundll32 Command Line
Windows renamed dctask64.exe execution via known IMPHASH values
Windows Process Creation: Detect dctask64.exe with Endpoint Central Execution/Injection Flags
Windows Remote Thread Injection Indicators via Process StartAddress Suffixes
Pivot detection · T1055.001 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.