Detect Remote Thread Creation in Sensitive Processes
Detects the creation of a remote thread in sensitive processes indicative of code injection techniques, such as APC or thread injection.
Microsoft Sentinel (KQL)

Detects the creation of a remote thread in sensitive processes indicative of code injection techniques, such as APC or thread injection.

Already have an account?