Windows HackTool CACTUSTORCH Remote Thread Creation via cscript/wscript/mshta/Office

title: Windows HackTool CACTUSTORCH Remote Thread Creation via cscript/wscript/mshta/Office
id: 81d7f804-1e79-4a22-8a14-7e92cfb94b03
status: test
description: This rule flags remote thread creation on Windows where the initiating process is cscript.exe, wscript.exe, mshta.exe, winword.exe, or excel.exe. The target image matches a SysWOW64 path while the StartModule field is empty, aligning with how CACTUSTORCH performs remote thread injection. This matters because remote thread creation is a common stealthy execution technique used to run attacker-controlled code inside another process. The detection relies on process creation telemetry that captures SourceImage, TargetImage, and StartModule.
references:
  - https://twitter.com/SBousseaden/status/1090588499517079552
  - https://github.com/mdsecactivebreach/CACTUSTORCH
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/create_remote_thread/create_remote_thread_win_hktl_cactustorch.yml
author: "@SBousseaden (detection), Thomas Patzke (rule), Huntrule Team"
date: 2019-02-01
modified: 2023-05-05
tags:
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1055.012
  - attack.t1059.005
  - attack.t1059.007
  - attack.t1218.005
logsource:
  product: windows
  category: create_remote_thread
detection:
  selection:
    SourceImage|endswith:
      - \System32\cscript.exe
      - \System32\wscript.exe
      - \System32\mshta.exe
      - \winword.exe
      - \excel.exe
    TargetImage|contains: \SysWOW64\
    StartModule: null
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 2e4e488a-6164-4811-9ea1-f960c7359c40
    type: derived