Rundll32 Create Remote Thread To A Process

This analytic detects the creation of a remote thread by rundll32.exe into another process, leveraging Sysmon EventCode 8 logs. This activity is a common technique used by malware, such as IcedID, to execute malicious code within legitimate processes, aiding in defense evasion and data theft. If confirmed malicious, this behavior could allow an attacker to execute arbitrary code, escalate privileges, and exfiltrate sensitive information from the compromised host.