Remote Thread Creation By Uncommon Source Image
Detects uncommon processes creating remote threads. This rule specifically looks for remote thread creation events where the source image is one of a predefined list of common Windows executables (explorer.exe, iexplore.exe, msiexec.exe, powerpnt.exe, schtasks.exe, winlogon.exe) and filters out known legitimate behaviors for these processes to reduce false positives. This activity can be indicative of process injection techniques used by malware or adversaries.
Sigma
