Windows Process Injection Remote Thread
Description
The following analytic detects suspicious remote thread execution in processes such as Taskmgr.exe, calc.exe, and notepad.exe, which may indicate process injection by malware like Qakbot. This detection leverages Sysmon EventCode 8 to identify remote thread creation in specific target processes. This activity is significant as it often signifies an attempt by malware to inject malicious code into legitimate processes, potentially leading to unauthorized code execution. If confirmed malicious, this could allow attackers to execute arbitrary code, escalate privileges, or maintain persistence on the compromised host.
Query · spl
`sysmon`
EventCode=8
TargetImage IN (
"*\\calc.exe",
"*\\CalculatorApp.exe",
"*\\cmd.exe",
"*\\dxdiag.exe",
"*\\explorer.exe",
"*\\mobsync.exe",
"*\\msra.exe",
"*\\notepad.exe",
"*\\OneDriveSetup.exe",
"*\\ping.exe",
"*\\powershell.exe",
"*\\rdpclip.exe",
"*\\Taskmgr.exe",
"*\\wermgr.exe",
"*\\win32calc.exe",
"*\\xwizard.exe"
)
| stats count min(_time) as firstTime
max(_time) as lastTime
values(NewThreadId) as "NewThreadId"
values(StartAddress) as "StartAddress"
by dest signature_id signature
SourceProcessGuid SourceProcessId SourceImage
TargetProcessGuid TargetProcessId TargetImage
StartModule StartFunction vendor_product
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_process_injection_remote_thread_filter`
Implementation guide
To successfully implement this search, you must be ingesting data that records process activity from your hosts like remote thread EventCode=8 of sysmon. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
Known false positives
- No false positives have been identified at this time.
Analyst notes
Known false positives: No false positives have been identified at this time.