Detects remote thread creation in the "mstsc.exe" process by a process located in a potentially suspicious location. This technique is often used by attackers in order to hook some APIs used by DLLs loaded by "mstsc.exe" during RDP authentications in order to steal credentials.

Read More

Detects the creation of a remote thread from a Powershell process in an uncommon target process

Read More

Detects remote thread creation from CACTUSTORCH as described in references.

Read More

Detects a potential remote threat creation with certain characteristics which are typical for Cobalt Strike beacons

Read More

Detects password dumper activity by monitoring remote thread creation EventID 8 in combination with the lsass.exe process as TargetImage. The process in field Process is the malicious program. A single execution can lead to hundreds of events.

Read More

Detects remote thread creation by PowerShell processes into "lsass.exe"

Read More

Detects uncommon processes creating remote threads.

Read More

Detects remote thread creation in "KeePass.exe" which could indicates potential password dumping activity

Read More

Detects remote thread creation in command shell applications, such as "Cmd.EXE" and "PowerShell.EXE". It is a common technique used by malware, such as IcedID, to inject malicious code and execute it within legitimate processes.

Read More

Detects uncommon processes creating remote threads.

Read More

Detects uncommon target processes for remote thread creation

Read More

Detects a remote thread creation of Ttdinject.exe used as proxy

Read More