Windows Remote Thread Creation via CACTUSTORCH Using Script/Office/Rundll Host Images
Alerts on SysWOW64 remote thread creation initiated by script host or Office binaries consistent with CACTUSTORCH behavior.
- Product
- windows
- Category
- create_remote_thread
- Author
- @SBousseaden (detection), Thomas Patzke (rule) (SigmaHQ), DRL 1.1
- Published
- 2019-02-01
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Defense EvasionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies remote thread creation when the SourceImage ends with common script or Office host processes (cscript.exe, wscript.exe, mshta.exe, winword.exe, excel.exe) and the TargetImage contains the SysWOW64 path. Such behavior matters because CACTUSTORCH-style execution often uses these binaries to obtain stealthy code execution and inject into other processes. Telemetry relies on Windows remote thread creation events that include SourceImage, TargetImage, and StartModule fields.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Remote Thread Creation via CACTUSTORCH Using Script/Office/Rundll Host Images
id: 81d7f804-1e79-4a22-8a14-7e92cfb94b03
status: test
description: This rule identifies remote thread creation when the SourceImage ends with common script or Office host processes (cscript.exe, wscript.exe, mshta.exe, winword.exe, excel.exe) and the TargetImage contains the SysWOW64 path. Such behavior matters because CACTUSTORCH-style execution often uses these binaries to obtain stealthy code execution and inject into other processes. Telemetry relies on Windows remote thread creation events that include SourceImage, TargetImage, and StartModule fields.
references:
- https://twitter.com/SBousseaden/status/1090588499517079552
- https://github.com/mdsecactivebreach/CACTUSTORCH
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/create_remote_thread/create_remote_thread_win_hktl_cactustorch.yml
author: "@SBousseaden (detection), Thomas Patzke (rule), Huntrule Team"
date: 2019-02-01
modified: 2023-05-05
tags:
- attack.privilege-escalation
- attack.execution
- attack.stealth
- attack.t1055.012
- attack.t1059.005
- attack.t1059.007
- attack.t1218.005
logsource:
product: windows
category: create_remote_thread
detection:
selection:
SourceImage|endswith:
- \System32\cscript.exe
- \System32\wscript.exe
- \System32\mshta.exe
- \winword.exe
- \excel.exe
TargetImage|contains: \SysWOW64\
StartModule: null
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 2e4e488a-6164-4811-9ea1-f960c7359c40
type: derived