Windows Remote Thread Created in KeePass.exe
Flags remote thread creation targeting KeePass.exe, a possible indicator of credential theft.
- Product
- windows
- Category
- create_remote_thread
- Author
- Timon Hackenjos (SigmaHQ), DRL 1.1
- Published
- 2022-04-22
- Updated
- 2026-07-31
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags creation of a remote thread targeting KeePass.exe. Attackers can use remote thread injection to execute code inside a password manager process, which may support credential theft or related credential-access activity. The detection relies on Windows telemetry that records remote thread creation events with a target process image path ending in '\KeePass.exe'.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Remote Thread Created in KeePass.exe
id: 23420a3c-e711-4fcd-ac9d-b23b5f27a84e
status: test
description: This rule flags creation of a remote thread targeting KeePass.exe. Attackers can use remote thread injection to execute code inside a password manager process, which may support credential theft or related credential-access activity. The detection relies on Windows telemetry that records remote thread creation events with a target process image path ending in '\KeePass.exe'.
references:
- https://www.cisa.gov/uscert/ncas/alerts/aa20-259a
- https://github.com/denandz/KeeFarce
- https://github.com/GhostPack/KeeThief
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/create_remote_thread/create_remote_thread_win_keepass.yml
author: Timon Hackenjos, Huntrule Team
date: 2022-04-22
modified: 2023-05-05
tags:
- attack.credential-access
- attack.t1555.005
logsource:
product: windows
category: create_remote_thread
detection:
selection:
TargetImage|endswith: \KeePass.exe
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 77564cc2-7382-438b-a7f6-395c2ae53b9a
type: derived