Windows Remote Thread Creation in mstsc.exe Triggered by Suspicious Source Paths

Alerts when mstsc.exe creates remote threads from processes running out of common suspicious directories.

FreeUnreviewedSigmahighv1

windows-remote-thread-creation-in-mstsc-exe-triggered-by-suspicious-source-paths-c0aac16a

title: Windows Remote Thread Creation in mstsc.exe Triggered by Suspicious Source Paths
id: c332733c-8cd1-4203-9fa0-f3f1b949912e
status: test
description: This rule flags creation of remote threads where the target process is mstsc.exe and the creating process originates from specific potentially suspicious filesystem locations. Attackers may use this behavior to interfere with mstsc.exe during RDP authentication, such as via DLL-related API hooking to capture credentials. It relies on Windows telemetry for remote thread creation events and includes process image path matching for both target and source processes.
references:
  - https://github.com/S12cybersecurity/RDPCredentialStealer/blob/1b8947cdd065a06c1b62e80967d3c7af895fcfed/APIHookInjectorBin/APIHookInjectorBin/Inject.h#L25
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/create_remote_thread/create_remote_thread_win_mstsc_susp_location.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-07-28
modified: 2024-01-22
tags:
  - attack.credential-access
logsource:
  product: windows
  category: create_remote_thread
detection:
  selection:
    TargetImage|endswith: \mstsc.exe
    SourceImage|contains:
      - :\Temp\
      - :\Users\Public\
      - :\Windows\PerfLogs\
      - :\Windows\Tasks\
      - :\Windows\Temp\
      - \AppData\Local\Temp\
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: c0aac16a-b1e7-4330-bab0-3c27bb4987c7
    type: derived

What it detects

This rule flags creation of remote threads where the target process is mstsc.exe and the creating process originates from specific potentially suspicious filesystem locations. Attackers may use this behavior to interfere with mstsc.exe during RDP authentication, such as via DLL-related API hooking to capture credentials. It relies on Windows telemetry for remote thread creation events and includes process image path matching for both target and source processes.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.