Rare Remote Thread Creation By Uncommon Source Image

 1title: Rare Remote Thread Creation By Uncommon Source Image
 2id: 02d1d718-dd13-41af-989d-ea85c7fab93f
 3related:
 4    - id: 66d31e5f-52d6-40a4-9615-002d3789a119
 5      type: derived
 6status: test
 7description: Detects uncommon processes creating remote threads.
 8references:
 9    - Personal research, statistical analysis
10    - https://lolbas-project.github.io
11author: Perez Diego (@darkquassar), oscd.community
12date: 2019-10-27
13modified: 2025-07-08
14tags:
15    - attack.privilege-escalation
16    - attack.defense-evasion
17    - attack.t1055
18logsource:
19    product: windows
20    category: create_remote_thread
21detection:
22    selection:
23        SourceImage|endswith:
24            - '\bash.exe'
25            - '\cscript.exe'
26            - '\cvtres.exe'
27            - '\defrag.exe'
28            - '\dialer.exe'
29            - '\dnx.exe'
30            - '\esentutl.exe'
31            - '\excel.exe'
32            - '\expand.exe'
33            - '\find.exe'
34            - '\findstr.exe'
35            - '\forfiles.exe'
36            - '\gpupdate.exe'
37            - '\hh.exe'
38            - '\installutil.exe'
39            - '\lync.exe'
40            - '\makecab.exe'
41            - '\mDNSResponder.exe'
42            - '\monitoringhost.exe' # Loads .NET CLR by default and thus a favorite for process injection for .NET in-memory offensive tools.
43            - '\msbuild.exe'
44            - '\mshta.exe'
45            - '\mspaint.exe'
46            - '\outlook.exe'
47            - '\ping.exe'
48            - '\provtool.exe'
49            - '\python.exe'
50            - '\regsvr32.exe'
51            - '\robocopy.exe'
52            - '\runonce.exe'
53            - '\sapcimc.exe'
54            - '\smartscreen.exe'
55            - '\spoolsv.exe'
56            - '\tstheme.exe'
57            - '\userinit.exe'
58            - '\vssadmin.exe'
59            - '\vssvc.exe'
60            - '\w3wp.exe'
61            - '\winscp.exe'
62            - '\winword.exe'
63            - '\wmic.exe'
64            - '\wscript.exe'
65    filter_main_conhost:
66        SourceImage:
67            - 'C:\Windows\System32\Defrag.exe'
68            - 'C:\Windows\System32\makecab.exe'
69        TargetImage: 'C:\Windows\System32\conhost.exe'
70    filter_main_provtol_svchost:
71        SourceImage: 'C:\Windows\System32\provtool.exe'
72        TargetImage: 'C:\Windows\System32\svchost.exe'
73    filter_main_userinit:
74        SourceImage: 'C:\Windows\System32\userinit.exe'
75        TargetImage: 'C:\Windows\explorer.exe'
76    filter_main_winword:
77        SourceImage|endswith: '\WINWORD.EXE'
78        TargetImage|startswith:
79            - 'C:\Program Files (x86)\' # C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
80            - 'C:\Program Files\' # C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\AI\ai.exe
81    filter_optional_explorer_vmtools:
82        SourceImage|endswith: '\SysWOW64\explorer.exe'
83        TargetImage:
84            - 'C:\Program Files (x86)\VMware\VMware Tools\vmtoolsd.exe'
85            - 'C:\Program Files\VMware\VMware Tools\vmtoolsd.exe'
86    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
87falsepositives:
88    - This rule is best put in testing first in order to create a baseline that reflects the data in your environment.
89level: high