Windows CreateRemoteThread in mstsc.exe From Suspicious Source Paths
Alerts when mstsc.exe creates remote threads from processes running out of common suspicious directories.
FreeReviewedSigma · High · v2
- Product
- windows
- Category
- create_remote_thread
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-07-28
- Updated
- 2026-07-31
What it detects
This rule identifies create-remote-thread activity where the target process is mstsc.exe, and the creating process originates from paths commonly associated with staging or temporary files. Attackers may use this behavior to inject or hook into mstsc.exe during RDP-related workflows to enable credential theft. Telemetry relied upon is process creation events that include both the target image (mstsc.exe) and the source image path for the remote thread creator.
Reporting behind it
- github.comhttps://github.com/S12cybersecurity/RDPCredentialStealer/blob/1b8947cdd065a06c1b62e80967d3c7af895fcfed/APIHookInjectorBin/APIHookInjectorBin/Inject.h#L25
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/create_remote_thread/create_remote_thread_win_mstsc_susp_location.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-remote-thread-creation-in-mstsc-exe-triggered-by-suspicious-source-paths-c0aac16a
title: Windows CreateRemoteThread in mstsc.exe From Suspicious Source Paths
id: c332733c-8cd1-4203-9fa0-f3f1b949912e
status: test
description: This rule identifies create-remote-thread activity where the target process is mstsc.exe, and the creating process originates from paths commonly associated with staging or temporary files. Attackers may use this behavior to inject or hook into mstsc.exe during RDP-related workflows to enable credential theft. Telemetry relied upon is process creation events that include both the target image (mstsc.exe) and the source image path for the remote thread creator.
references:
- https://github.com/S12cybersecurity/RDPCredentialStealer/blob/1b8947cdd065a06c1b62e80967d3c7af895fcfed/APIHookInjectorBin/APIHookInjectorBin/Inject.h#L25
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/create_remote_thread/create_remote_thread_win_mstsc_susp_location.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-07-28
modified: 2024-01-22
tags:
- attack.credential-access
logsource:
product: windows
category: create_remote_thread
detection:
selection:
TargetImage|endswith: \mstsc.exe
SourceImage|contains:
- :\Temp\
- :\Users\Public\
- :\Windows\PerfLogs\
- :\Windows\Tasks\
- :\Windows\Temp\
- \AppData\Local\Temp\
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: c0aac16a-b1e7-4330-bab0-3c27bb4987c7
type: derived