Waiting Thread Hijacking
Detects a process opening a handle to a thread with rights to set the thread's context. This is a key indicator of thread hijacking techniques, where an adversary manipulates a waiting thread in a legitimate process to execute malicious code.
Sigma
