Remote thread into system process
A thread was created inside another process, and the target is one of the processes attackers habitually inject into.
What it detects
A thread was created inside another process, and the target is one of the processes attackers habitually inject into.
Why these targets: explorer.exe and svchost.exe run continuously as the user or SYSTEM and their network activity is unremarkable, so code hosted there inherits a trustworthy identity. notepad.exe, calc.exe and mspaint.exe are the classic demonstration and staging targets — small, quick to start, and unlikely to be noticed. lsass.exe and winlogon.exe are credential-bearing.
This complements windows.injection.remote_thread_from_scratch_dir, which keys on the SOURCE being in a temp or user directory. That misses the common case where the injector is a legitimate signed interpreter: a real capture in the benchmark corpus shows powershell.exe creating a remote thread in notepad.exe, and another shows the source running from a network share. Keying on the TARGET catches both.
MITRE ATT&CK mapping
False positives and triage
Remote thread creation is rare but not unheard of in legitimate software — debuggers, some installers, endpoint-security agents and a few updater stacks do it deliberately. Baseline the agents running on the host.
To confirm: SourceImage is the question. A signed security agent is expected; an interpreter (powershell.exe, wscript.exe, mshta.exe), a binary on a network share or removable drive, or anything in a user-writable directory is the finding. StartModule and StartAddress tell you where the new thread began — an address with no module behind it means the injected code was never on disk. Then check what the TARGET process did next: injection is a means, and the payload's network connections or file writes are the actual damage.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 85%. Source: rules/windows/remote_thread_into_system_process.yaml, licensed under the Apache License 2.0.
id: windows.injection.remote_thread_into_system_process
version: 1.0.0
status: stable
severity: critical
confidence: 0.85
platforms: [windows]
mitre_techniques: [T1055, T1055.002]
description: |
A thread was created inside another process, and the target is one of the processes
attackers habitually inject into.
Why these targets: `explorer.exe` and `svchost.exe` run continuously as the user or
SYSTEM and their network activity is unremarkable, so code hosted there inherits a
trustworthy identity. `notepad.exe`, `calc.exe` and `mspaint.exe` are the classic
demonstration and staging targets — small, quick to start, and unlikely to be
noticed. `lsass.exe` and `winlogon.exe` are credential-bearing.
This complements `windows.injection.remote_thread_from_scratch_dir`, which keys on
the SOURCE being in a temp or user directory. That misses the common case where the
injector is a legitimate signed interpreter: a real capture in the benchmark corpus
shows `powershell.exe` creating a remote thread in `notepad.exe`, and another shows
the source running from a network share. Keying on the TARGET catches both.
match:
event_action: remote_thread_created
raw_message_regex: '(?i)TargetImage=\S*\\(explorer|notepad|svchost|lsass|winlogon|rundll32|dllhost|spoolsv|calc|mspaint|wermgr|werfault|searchindexer)\.exe'
correlation_keys: [hostname, user_name]
false_positive_guidance: |
Remote thread creation is rare but not unheard of in legitimate software —
debuggers, some installers, endpoint-security agents and a few updater stacks do it
deliberately. Baseline the agents running on the host.
To confirm: `SourceImage` is the question. A signed security agent is expected; an
interpreter (`powershell.exe`, `wscript.exe`, `mshta.exe`), a binary on a network
share or removable drive, or anything in a user-writable directory is the finding.
`StartModule` and `StartAddress` tell you where the new thread began — an address
with no module behind it means the injected code was never on disk. Then check what
the TARGET process did next: injection is a means, and the payload's network
connections or file writes are the actual damage.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.