Reflective DLL Injection via CreateRemoteThread into Trusted Host Process
Detects instances of CreateRemoteThread API calls targeting sensitive host processes (svchost.exe, explorer.exe, lsass.exe, etc.) where the source process is not a recognized system component. This behavior is indicative of reflective DLL injection, a technique often used to execute code within the address space of a remote process to bypass security controls or user-mode hooks.
Sigma
