Remote Thread Creation In Uncommon Target Image

SigmaHQ Detections@sigmaHQ

•updated Jul 8, 2025•0•19

Detects remote thread creation in uncommon target processes such as 'calc.exe', 'notepad.exe', 'mspaint.exe', 'ping.exe', 'sethc.exe', 'spoolsv.exe', 'wordpad.exe', and 'write.exe'. This activity can indicate process injection techniques used for defense evasion or privilege escalation.