title: Remote Thread Creation in Suspicious Targets
id: a1a144b7-5c9b-4853-a559-2172be8d4a03
status: experimental
description: Detects a remote thread creation in suspicious taregt images
references:
   - https://blog.redbluepurple.io/offensive-research/bypassing-injection-detection
author: Florian Roth
date: 2022/03/16
logsource:
   product: windows
   category: create_remote_thread
detection:
   selection:
      TargetImage|endswith: 
         - '\mspaint.exe'
         - '\calc.exe'
         - '\notepad.exe'
         - '\sethc.exe'
         - '\write.exe'
         - '\wordpad.exe'
   condition: selection
falsepositives:
   - Unknown
level: high
