Windows: CreateRemoteThread with StartAddress Ending in 0B80/0C7C/0C88

title: "Windows: CreateRemoteThread with StartAddress Ending in 0B80/0C7C/0C88"
id: dd176383-88e6-468b-aa41-5fe445eacef3
status: test
description: This rule identifies Windows process remote thread creation events where the StartAddress ends with 0B80, 0C7C, or 0C88. Attackers commonly use remote threads for stealthy execution in a separate process, and these StartAddress suffixes are used as behavioral indicators associated with Cobalt Strike beacons. It relies on telemetry from process/thread creation, specifically the StartAddress value from create remote thread activity.
references:
  - https://medium.com/@olafhartong/cobalt-strike-remote-threads-detection-206372d11d0f
  - https://blog.cobaltstrike.com/2018/04/09/cobalt-strike-3-11-the-snake-that-eats-its-tail/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/create_remote_thread/create_remote_thread_win_hktl_cobaltstrike.yml
author: Olaf Hartong, Florian Roth (Nextron Systems), Aleksey Potapov, oscd.community, Huntrule Team
date: 2018-11-30
modified: 2023-05-05
tags:
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1055.001
logsource:
  product: windows
  category: create_remote_thread
detection:
  selection:
    StartAddress|endswith:
      - 0B80
      - 0C7C
      - 0C88
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 6309645e-122d-4c5b-bb2b-22e4f9c2fa42
    type: derived