huntrule

Windows PowerShell Remote Thread Creation via CreateRemoteThread

Alerts when PowerShell creates a remote thread in another process, excluding CompatTelRunner.exe activity.

FreeUnreviewedSigmamediumv1
title: Windows PowerShell Remote Thread Creation via CreateRemoteThread
id: e7769490-b512-495d-9c1f-b2da9efaeb15
related:
  - id: 99b97608-3e21-4bfe-8217-2a127c396a0e
    type: derived
  - id: eeb2e3dc-c1f4-40dd-9bd5-149ee465ad50
    type: derived
status: test
description: This rule flags cases where a PowerShell host process (powershell.exe or pwsh.exe) is observed creating a remote thread into another process. Remote thread creation is a common technique for stealthy in-memory execution and process manipulation, so it is a high-signal indicator of suspicious cross-process activity. The detection relies on telemetry indicating the source executable and parent executable context, with exclusions for activity originating from CompatTelRunner.exe.
references:
  - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/create_remote_thread/create_remote_thread_win_powershell_generic.yml
author: Nikita Nazarov, oscd.community, Huntrule Team
date: 2020-10-06
modified: 2023-11-10
tags:
  - attack.execution
  - attack.t1059.001
  - detection.threat-hunting
logsource:
  product: windows
  category: create_remote_thread
detection:
  selection:
    SourceImage|endswith:
      - \powershell.exe
      - \pwsh.exe
  filter_main_compattelrunner:
    SourceParentImage|endswith: :\Windows\System32\CompatTelRunner.exe
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1

What it detects

This rule flags cases where a PowerShell host process (powershell.exe or pwsh.exe) is observed creating a remote thread into another process. Remote thread creation is a common technique for stealthy in-memory execution and process manipulation, so it is a high-signal indicator of suspicious cross-process activity. The detection relies on telemetry indicating the source executable and parent executable context, with exclusions for activity originating from CompatTelRunner.exe.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.