Remote thread from scratch dir
A process running from a scratch / user-writable directory created a thread in ANOTHER process (Sysmon CreateRemoteThread, Event ID 8).
What it detects
A process running from a scratch / user-writable directory created a thread in ANOTHER process (Sysmon CreateRemoteThread, Event ID 8). Cross-process thread creation is the core process-injection primitive — dropping code into a live process (often a benign one like explorer.exe or svchost.exe) to run under its identity and evade process-based controls. Legitimate injectors (debuggers, some AV) run from Program Files / System32; an injector running from Temp, AppData, Public, ProgramData, or Downloads is the malicious shape. Realises a catalogued behaviour (injection from a scratch directory).
MITRE ATT&CK mapping
- T1055Process Injection· Privilege Escalation
False positives and triage
A few legitimate tools (installers, some Electron/updater stacks staged in AppData) create remote threads. The strong signal is an UNSIGNED or unusual SourceImage in a scratch path injecting into a system or user-facing process. Confirm the source binary's signature and parent, and the target it injected into; allow-list a known updater's SourceImage if needed.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 70%. Source: rules/windows/remote_thread_from_scratch_dir.yaml, licensed under the Apache License 2.0.
id: windows.injection.remote_thread_from_scratch_dir
version: 1.0.0
status: stable
severity: high
confidence: 0.7
platforms: [windows]
mitre_techniques: [T1055]
description: |
A process running from a scratch / user-writable directory created a thread in ANOTHER
process (Sysmon CreateRemoteThread, Event ID 8). Cross-process thread creation is the core
process-injection primitive — dropping code into a live process (often a benign one like
explorer.exe or svchost.exe) to run under its identity and evade process-based controls.
Legitimate injectors (debuggers, some AV) run from Program Files / System32; an injector
running from Temp, AppData, Public, ProgramData, or Downloads is the malicious shape.
Realises behavioural catalog BEH-034 (injection from a scratch directory).
match:
event_action: remote_thread_created
process_path_contains_any:
- "\\Temp\\"
- "\\AppData\\"
- "\\Users\\Public\\"
- "\\ProgramData\\"
- "\\Downloads\\"
false_positive_guidance: |
A few legitimate tools (installers, some Electron/updater stacks staged in AppData) create
remote threads. The strong signal is an UNSIGNED or unusual SourceImage in a scratch path
injecting into a system or user-facing process. Confirm the source binary's signature and
parent, and the target it injected into; allow-list a known updater's SourceImage if needed.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.