Remote Thread Creation Via PowerShell

calendarApr 3, 2023 · attack.execution attack.t1059.001  ·
Share on: linkedincopy

Detects the creation of a remote thread from a Powershell process to another process

Sigma rule (View on GitHub)

 1title: Remote Thread Creation Via PowerShell
 2id: eeb2e3dc-c1f4-40dd-9bd5-149ee465ad50
 3related:
 4    - id: 99b97608-3e21-4bfe-8217-2a127c396a0e
 5      type: derived
 6status: test
 7description: Detects the creation of a remote thread from a Powershell process to another process
 8references:
 9    - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse
10author: Nikita Nazarov, oscd.community
11date: 2020/10/06
12modified: 2023/03/28
13tags:
14    - attack.execution
15    - attack.t1059.001
16logsource:
17    product: windows
18    category: create_remote_thread
19detection:
20    selection:
21        SourceImage|endswith:
22            - '\powershell.exe'
23            - '\pwsh.exe'
24    filter_main_compattelrunner:
25        SourceParentImage: 'C:\Windows\System32\CompatTelRunner.exe'
26    condition: selection and not 1 of filter_main_*
27falsepositives:
28    - Unknown
29level: medium

Related rules

to-top