Potential Cobalt Strike Process Injection via Remote Thread Creation

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•21

Detects potential remote thread creation with specific start addresses often associated with Cobalt Strike beacons, indicating process injection activity.