Remote Thread Creation Via PowerShell In Uncommon Target

SigmaHQ Detections@sigmaHQ

•updated Oct 1, 2024•0•18

This rule detects the creation of a remote thread by a PowerShell process (powershell.exe or pwsh.exe) into specific target processes, namely rundll32.exe or regsvr32.exe. This activity is often indicative of defense evasion and execution techniques used by adversaries to inject malicious code or achieve persistence by leveraging legitimate system binaries.