Windows PowerShell Remote Thread Creation into rundll32.exe or regsvr32.exe

Alerts on PowerShell creating remote threads in rundll32.exe or regsvr32.exe on Windows.

FreeUnreviewedSigmamediumv1

windows-powershell-remote-thread-creation-into-rundll32-exe-or-regsvr32-exe-99b97608

title: Windows PowerShell Remote Thread Creation into rundll32.exe or regsvr32.exe
id: dfe4e599-1525-4838-8b57-873b895238cb
related:
  - id: eeb2e3dc-c1f4-40dd-9bd5-149ee465ad50
    type: similar
  - id: 99b97608-3e21-4bfe-8217-2a127c396a0e
    type: derived
status: test
description: This rule flags when a PowerShell process (powershell.exe or pwsh.exe) creates a remote thread in an unusual target process (rundll32.exe or regsvr32.exe). Creating a remote thread can be used to inject code into another process to evade defenses and execute attacker-controlled functionality. It relies on telemetry that records process create-remote-thread events with both the source and target image paths.
references:
  - https://www.fireeye.com/blog/threat-research/2018/06/bring-your-own-land-novel-red-teaming-technique.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/create_remote_thread/create_remote_thread_win_powershell_susp_targets.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2018-06-25
modified: 2023-11-10
tags:
  - attack.execution
  - attack.stealth
  - attack.t1218.011
  - attack.t1059.001
logsource:
  product: windows
  category: create_remote_thread
detection:
  selection:
    SourceImage|endswith:
      - \powershell.exe
      - \pwsh.exe
    TargetImage|endswith:
      - \rundll32.exe
      - \regsvr32.exe
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1

What it detects

This rule flags when a PowerShell process (powershell.exe or pwsh.exe) creates a remote thread in an unusual target process (rundll32.exe or regsvr32.exe). Creating a remote thread can be used to inject code into another process to evade defenses and execute attacker-controlled functionality. It relies on telemetry that records process create-remote-thread events with both the source and target image paths.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.