CACTUSTORCH Remote Thread Creation via Scripting Engines

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•26

Detects remote thread creation initiated by specific scripting engines or Microsoft Office applications (cscript.exe, wscript.exe, mshta.exe, winword.exe, excel.exe) into processes within the SysWOW64 directory, where the start module is null. This behavior is characteristic of the CACTUSTORCH hack tool, which injects shellcode into legitimate processes to evade detection.