Windows Remote Thread Injection Indicators via Process StartAddress Suffixes
Flags Windows CreateRemoteThread events with StartAddress suffixes 0B80, 0C7C, or 0C88.
- Product
- windows
- Category
- create_remote_thread
- Author
- Olaf Hartong, Florian Roth (Nextron Systems), Aleksey Potapov, oscd.community (SigmaHQ), DRL 1.1
- Published
- 2018-11-30
- Updated
- 2026-07-31
ATT&CK techniques
Priv Esc → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags creation of a remote thread where the StartAddress ends with specific hexadecimal suffixes associated with Cobalt Strike beacon behavior. Attackers may use remote thread injection to execute payload code within another process, improving stealth and persistence. The detection relies on Windows telemetry for remote thread creation events and the StartAddress value suffix matching those patterns.
Reporting behind it
- medium.comhttps://medium.com/@olafhartong/cobalt-strike-remote-threads-detection-206372d11d0f
- blog.cobaltstrike.comhttps://blog.cobaltstrike.com/2018/04/09/cobalt-strike-3-11-the-snake-that-eats-its-tail/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/create_remote_thread/create_remote_thread_win_hktl_cobaltstrike.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Remote Thread Injection Indicators via Process StartAddress Suffixes
id: dd176383-88e6-468b-aa41-5fe445eacef3
status: test
description: This rule flags creation of a remote thread where the StartAddress ends with specific hexadecimal suffixes associated with Cobalt Strike beacon behavior. Attackers may use remote thread injection to execute payload code within another process, improving stealth and persistence. The detection relies on Windows telemetry for remote thread creation events and the StartAddress value suffix matching those patterns.
references:
- https://medium.com/@olafhartong/cobalt-strike-remote-threads-detection-206372d11d0f
- https://blog.cobaltstrike.com/2018/04/09/cobalt-strike-3-11-the-snake-that-eats-its-tail/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/create_remote_thread/create_remote_thread_win_hktl_cobaltstrike.yml
author: Olaf Hartong, Florian Roth (Nextron Systems), Aleksey Potapov, oscd.community, Huntrule Team
date: 2018-11-30
modified: 2023-05-05
tags:
- attack.privilege-escalation
- attack.stealth
- attack.t1055.001
logsource:
product: windows
category: create_remote_thread
detection:
selection:
StartAddress|endswith:
- 0B80
- 0C7C
- 0C88
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 6309645e-122d-4c5b-bb2b-22e4f9c2fa42
type: derived