Windows: Remote Thread Created in KeePass.exe

Flags remote thread creation targeting KeePass.exe, a possible indicator of credential theft.

FreeUnreviewedSigmahighv1

windows-remote-thread-created-in-keepass-exe-77564cc2

title: "Windows: Remote Thread Created in KeePass.exe"
id: 23420a3c-e711-4fcd-ac9d-b23b5f27a84e
status: test
description: This rule identifies when a process creates a remote thread targeting KeePass.exe (by matching the target image path ending with '\KeePass.exe'). Remote thread creation against a credential manager can indicate malicious in-memory code execution aimed at harvesting credentials. Detection relies on Windows remote thread creation telemetry that includes the target image name/path.
references:
  - https://www.cisa.gov/uscert/ncas/alerts/aa20-259a
  - https://github.com/denandz/KeeFarce
  - https://github.com/GhostPack/KeeThief
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/create_remote_thread/create_remote_thread_win_keepass.yml
author: Timon Hackenjos, Huntrule Team
date: 2022-04-22
modified: 2023-05-05
tags:
  - attack.credential-access
  - attack.t1555.005
logsource:
  product: windows
  category: create_remote_thread
detection:
  selection:
    TargetImage|endswith: \KeePass.exe
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 77564cc2-7382-438b-a7f6-395c2ae53b9a
    type: derived

What it detects

This rule identifies when a process creates a remote thread targeting KeePass.exe (by matching the target image path ending with '\KeePass.exe'). Remote thread creation against a credential manager can indicate malicious in-memory code execution aimed at harvesting credentials. Detection relies on Windows remote thread creation telemetry that includes the target image name/path.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.