huntrule

Windows Remote Thread Creation via CACTUSTORCH Using Script/Office/Rundll Host Images

Alerts on SysWOW64 remote thread creation initiated by script host or Office binaries consistent with CACTUSTORCH behavior.

FreeReviewedSigma · High · v2
Product
windows
Category
create_remote_thread
Author
@SBousseaden (detection), Thomas Patzke (rule) (SigmaHQ), DRL 1.1
Published
2019-02-01
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Execution → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies remote thread creation when the SourceImage ends with common script or Office host processes (cscript.exe, wscript.exe, mshta.exe, winword.exe, excel.exe) and the TargetImage contains the SysWOW64 path. Such behavior matters because CACTUSTORCH-style execution often uses these binaries to obtain stealthy code execution and inject into other processes. Telemetry relies on Windows remote thread creation events that include SourceImage, TargetImage, and StartModule fields.

Reporting behind it

Related detections9 linkedT1059.005 — drag to rearrange
Windows: Alert on suspicious parent process spawning csc.exe
Suspicious Script Host Execution of Decoy-Named JavaScript Dropper (PS1Bot)
Suspicious MSHTA VBScript WScript Shell Execution
Suspicious Wscript Execution of JavaScript From AppData Local Temp via Process Creation (via process_creation)
Windows AppLocker Audit-Mode Events Indicate Files Would Have Been Blocked
Windows Wscript/Cscript Executes Files with Uncommon Non-Script Extensions
Windows WScript/CScript File Write With Script Extensions to Temp or Startup Paths
Windows AppLocker Blocked Application, Script, MSI, or Packaged-App Execution
Windows Process Creation: Suspicious Children Spawned by HTML Help (hh.exe)
Windows Remote Thread Creation via CACTUSTORCH Using Script/Office/Rundll Host Images
Pivot detection · T1059.005 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.