Windows Remote Thread Creation Targeting Uncommon System Image Processes
Alert on Windows remote thread creation events targeting a predefined list of uncommon processes by image path.
- Product
- windows
- Category
- create_remote_thread
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-03-16
- Updated
- 2026-07-31
ATT&CK techniques
Priv Esc → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows remote thread creation events where the TargetImage ends with a short list of commonly abused or sensitive executables (e.g., calc, notepad, sethc, spoolsv). Attackers use remote thread creation to execute code in another process while attempting to blend in with normal Windows activity. The detection relies on Windows event telemetry for process remote thread creation, including SourceImage, TargetImage, and StartFunction, plus explicit exclusions for several known benign source/target combinations.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Remote Thread Creation Targeting Uncommon System Image Processes
id: 63b922ce-fe67-41be-bb49-9bf389b92755
related:
- id: f016c716-754a-467f-a39e-63c06f773987
type: obsolete
- id: a1a144b7-5c9b-4853-a559-2172be8d4a03
type: derived
status: test
description: This rule flags Windows remote thread creation events where the TargetImage ends with a short list of commonly abused or sensitive executables (e.g., calc, notepad, sethc, spoolsv). Attackers use remote thread creation to execute code in another process while attempting to blend in with normal Windows activity. The detection relies on Windows event telemetry for process remote thread creation, including SourceImage, TargetImage, and StartFunction, plus explicit exclusions for several known benign source/target combinations.
references:
- https://web.archive.org/web/20220319032520/https://blog.redbluepurple.io/offensive-research/bypassing-injection-detection
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/create_remote_thread/create_remote_thread_win_susp_uncommon_target_image.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-03-16
modified: 2025-07-04
tags:
- attack.privilege-escalation
- attack.stealth
- attack.t1055.003
logsource:
product: windows
category: create_remote_thread
detection:
selection:
TargetImage|endswith:
- \calc.exe
- \calculator.exe
- \mspaint.exe
- \notepad.exe
- \ping.exe
- \sethc.exe
- \spoolsv.exe
- \wordpad.exe
- \write.exe
filter_main_csrss:
SourceImage: C:\Windows\System32\csrss.exe
filter_main_notepad:
SourceImage:
- C:\Windows\System32\explorer.exe
- C:\Windows\System32\OpenWith.exe
TargetImage: C:\Windows\System32\notepad.exe
filter_main_sethc:
SourceImage: C:\Windows\System32\AtBroker.exe
TargetImage: C:\Windows\System32\Sethc.exe
filter_optional_aurora_1:
StartFunction: EtwpNotificationThread
filter_optional_aurora_2:
SourceImage|contains: unknown process
filter_optional_vmtoolsd:
SourceImage: C:\Program Files\VMware\VMware Tools\vmtoolsd.exe
StartFunction: GetCommandLineW
TargetImage:
- C:\Windows\System32\notepad.exe
- C:\Windows\System32\spoolsv.exe
filter_optional_xerox_pjems:
SourceImage: C:\Program Files\Xerox\XeroxPrintExperience\CommonFiles\XeroxPrintJobEventManagerService.exe
StartFunction: LoadLibraryW
TargetImage: C:\Windows\System32\spoolsv.exe
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1