Waiting Thread Hijacking Detection
This rule detects Waiting Thread Hijacking (WTH) by identifying sequences of API calls indicative of process injection. It includes three main detection logics: a basic sequence of OpenThread, Allocate, and Write operations; a more specific API sequence that checks for THREAD_GET_CONTEXT access and two separate write operations; and a split execution variant where multiple processes target a single victim process with memory allocation, write, and protect operations. The rule aims to catch malicious code injection into remote processes.
Microsoft Sentinel (KQL)
