KeePass remote thread
A thread was created inside KeePass.exe from another process — Sysmon event 8 with KeePass as the target.
What it detects
A thread was created inside KeePass.exe from another process — Sysmon event 8 with KeePass as the target. KeePass keeps the unlocked database and the master key in its own memory, and injecting a thread is how tooling such as KeeThief reaches in and reads them out while the vault is open.
Nothing legitimate does this. KeePass has a plugin API for extensions and does not need a foreign process to create threads in it, so a single event is enough for a high-severity finding: the password manager has just been read by someone who is not the user.
MITRE ATT&CK mapping
False positives and triage
Expect almost none. The candidates are endpoint security products that inject into every process (identify them by the SourceImage — an EDR or AV binary from Program Files), and debugging by a developer working on KeePass itself. Anything else, and in particular a SourceImage under a user profile, Temp, or an unsigned binary, should be treated as credential theft in progress: assume every entry in that vault is compromised and start rotation.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 80%. Source: rules/windows/keepass_remote_thread.yaml, licensed under the Apache License 2.0.
id: windows.credential.keepass_remote_thread
version: 1.0.0
status: stable
severity: high
confidence: 0.8
platforms: [windows]
mitre_techniques: [T1555.005, T1055]
description: |
A thread was created inside `KeePass.exe` from another process — Sysmon event 8
with KeePass as the target. KeePass keeps the unlocked database and the master
key in its own memory, and injecting a thread is how tooling such as KeeThief
reaches in and reads them out while the vault is open.
Nothing legitimate does this. KeePass has a plugin API for extensions and does
not need a foreign process to create threads in it, so a single event is enough
for a high-severity finding: the password manager has just been read by someone
who is not the user.
match:
event_action: remote_thread_created
# `.*?` not `\S*`: KeePass installs to "C:\Program Files\KeePass Password Safe 2\",
# whose spaces a non-whitespace class cannot cross. Lazy so it stops at the first
# \KeePass.exe rather than running into a later field.
raw_message_regex: '(?i)TargetImage=[a-z]:\\.*?\\KeePass\.exe\b'
correlation_keys: [hostname, user_name]
false_positive_guidance: |
Expect almost none. The candidates are endpoint security products that inject into
every process (identify them by the SourceImage — an EDR or AV binary from
`Program Files`), and debugging by a developer working on KeePass itself. Anything
else, and in particular a SourceImage under a user profile, Temp, or an
unsigned binary, should be treated as credential theft in progress: assume every
entry in that vault is compromised and start rotation.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.