Remote thread created inside a credential-handling process

Siemphony@siemphonylowT1055+1unverified

AN0389 asks for a memory modification correlated with a hook-installation routine inside a credential-sensitive process. Of the three log sources the analytic supplies, Sysmon EventID 8 is the only one where the memory modification and the process it lands in arrive on a single event, so the rule sits there and matches on TargetImage alone. MITRE names explorer.exe and winlogon.exe under its TargetProcess knob; logonui.exe, credentialuibroker.exe and the three browsers are added here rather than taken from MITRE — the two logon-UI processes because they render the credential prompt itself, and the browsers because the banking-trojan lineage MITRE cites for this technique hooks the network and credential-store APIs inside chrome.exe and firefox.exe. lsass.exe was deliberately removed from the target list: it renders no credential UI and exports no credential-entry function to hook, and a memory-read handle opened against it is already published in this corpus under T1003.001. Read any hit as process injection first. A remote thread created in another process is the canonical observable for T1055, and nothing on this event says the injected code installs a hook, so T1055 — and, for the browsers, ordinary accessibility or content-inspection injection — has to be ruled out before this is read as credential hooking. The rule is deliberately not narrowed by StartFunction or StartModule: the textbook injection resolves to LoadLibraryA or LoadLibraryW in kernel32, but a hook installed from position-independent code leaves StartFunction empty, and requiring the name would drop exactly the quieter half — the cost is that every remote thread into these seven processes alerts, benign or not, which is why the level is low. Two of MITRE's three hooking mechanisms are out of reach entirely: IAT and inline patching performed with WriteProcessMemory from a thread that already exists produces no EventID 8, and SetWindowsHookEx installs a hook with no remote thread either. Those two are visible only through EDR API telemetry, or through an image_load rule on an unexpected DLL appearing across many processes at once, and neither is among this strategy's log sources — so a clean result here is not evidence against T1056.004 in any of its forms. explorer.exe is the noisiest member of the target list and is present because MITRE names it; on an estate where the shell is routinely extended by third-party software, dropping it and keeping the logon and credential-prompt processes removes most of the volume at the cost of missing hooks placed in the shell. EventID 8 must be enabled in the Sysmon configuration and is sometimes dropped for volume on busy hosts, which reads as quiet rather than clean. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0139, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 3 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Splunk · SPL

Run this as a search.

index=* (TargetImage="*\\winlogon.exe" OR TargetImage="*\\explorer.exe" OR TargetImage="*\\logonui.exe" OR TargetImage="*\\credentialuibroker.exe" OR TargetImage="*\\chrome.exe" OR TargetImage="*\\msedge.exe" OR TargetImage="*\\firefox.exe")

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(TargetImage) LIKE "*\\\\winlogon.exe" OR TO_LOWER(TargetImage) LIKE "*\\\\explorer.exe" OR TO_LOWER(TargetImage) LIKE "*\\\\logonui.exe" OR TO_LOWER(TargetImage) LIKE "*\\\\credentialuibroker.exe" OR TO_LOWER(TargetImage) LIKE "*\\\\chrome.exe" OR TO_LOWER(TargetImage) LIKE "*\\\\msedge.exe" OR TO_LOWER(TargetImage) LIKE "*\\\\firefox.exe")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,create_remote_thread,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="TargetImage" type="pcre2">(?i)(\\winlogon\.exe$|\\explorer\.exe$|\\logonui\.exe$|\\credentialuibroker\.exe$|\\chrome\.exe$|\\msedge\.exe$|\\firefox\.exe$)</field>    <description>Remote thread created inside a credential-handling process</description>    <mitre>      <id>T1056.004</id>      <id>T1055</id>    </mitre>  </rule></group>

Sentinel · KQL

Run this as a search.

Sentinel cannot express this construct. No Sentinel table is modelled for this logsource ({"category":"create_remote_thread","product":"windows"}), so there is nothing honest to query. Pick a logsource this translator maps, or write the KQL by hand. The Sigma source is on the first tab, unchanged.

At a glance

Logsource: create_remote_thread / windows
Level: low
Category: process_injection
Sigma status: experimental
Backends: 3 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 3e25d626-50df-4591-91ee-92eb554d0bd8

ATT&CKT1055 +1

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonprocess injection

process injection

01 · What this rule detects

One process opening another and writing into its memory or steering its execution, so that attacker code runs inside a process the environment already trusts. The detectable part is rarely the payload — it is the precursors: a handle request carrying write and execute rights, a thread created in another process, or an image replaced after the process started. It matters because everything the injected code does afterwards is attributed to the host process, so a rule further down the chain will name the wrong binary.

02 · Telemetry you need

Sysmon EventID 10 (ProcessAccess) SourceImage, TargetImage, GrantedAccess and CallTrace — the access mask carries the signal, and CallTrace is only readable if symbol resolution is configured
Sysmon EventID 8 (CreateRemoteThread) SourceImage, TargetImage, StartAddress, StartModule, StartFunction
Sysmon EventID 25 (ProcessTampering) for image replacement and hollowing
Process creation with parentage — Sysmon EventID 1 carries CommandLine and ParentImage together; Security 4688 NewProcessName requires Audit Process Creation, and its CommandLine field needs the separate 'Include command line in process creation events' policy. Both are off by default
EDR API telemetry for VirtualAllocEx, WriteProcessMemory and APC queuing where the product exposes it — Windows itself does not log these calls

03 · How the logic works

The primary rule is a process-access rule: match EventID 10 where GrantedAccess includes the rights injection needs — write to memory, create a thread, operate the virtual memory of the target — and where TargetImage is a process worth injecting into. Note the trap: GrantedAccess is recorded as a hexadecimal string, and Sigma has no bitwise operator, so a rule written as an equality match only catches the exact masks you thought to enumerate. Either list the masks you actually observe from real tooling and revisit the list, or push the bit test down into the backend query where the language supports it. The remote-thread and tampering events are narrower and much quieter, so they make good standalone rules rather than filters on the first one. SourceImage is the field to anchor exclusions on; TargetImage is the field that decides whether an analyst should care.

04 · Common false positives

Endpoint protection and EDR agents, which inject and inspect by design — MsMpEng.exe and the equivalent vendor services
Windows Error Reporting (WerFault.exe) opening a crashing process with broad rights
Application performance monitoring and .NET or Java profilers that attach to instrument running code
Remote support, screen recording and accessibility software that hooks other applications, and VDI agents such as Citrix that hook the session
Debuggers attaching during development, including the just-in-time debugger

05 · Detection maturity

Tier 1 — starting point: Matches remote thread creation into any process, or a fixed list of access masks.
Tier 2 — tuned: Matches process access to a defined set of targets with injection-relevant rights, excluding security and diagnostic tooling by signed path.
Tier 3 — correlated: Correlates the access with the source process's own creation, signature status and what it did on the network afterwards.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Exclude by the full signed path of SourceImage, never by filename — a copied binary in a temp directory keeps the filename
Keep the target list short and meaningful: browsers, LSASS, explorer.exe and your own line-of-business applications say more than a match on everything
Enumerate the access masks you see in your own environment before you write the match, and treat the list as something that ages
WerFault.exe will open almost anything with almost any rights — scope its exclusion to WerFault as the source, not to the target it touched
Raise severity when the source process is unsigned or was created in the same minute as the access

Declared by the author

Endpoint protection, EDR and application-performance agents that inject a monitoring DLL into explorer.exe, the logon processes and the browsers at every user logon. This is the dominant source and it fires on every host, but it comes from a small and stable set of SourceImage values per estate, which is where the exclusion belongs — MITRE's TargetProcess knob narrows the target list, but SourceImage is the field that actually separates these.
Windows' own components creating remote threads during session setup, fast user switching, shell restarts and error reporting — svchost.exe, csrss.exe, taskhostw.exe and WerFault.exe appear as SourceImage against explorer.exe and winlogon.exe on a healthy host, so an exclusion list built only from vendor agent paths still leaves this volume behind.
Session-brokering, VDI and remote-display products — profile managers, printer redirectors and single sign-on agents — that thread into winlogon.exe or explorer.exe to hook the shell or the logon path. Legitimate, and structurally identical to credential hooking.
Browser-injecting software that is not malware: accessibility tools and screen readers, password-manager helpers, enterprise DLP and browser-isolation agents, and attaching a debugger, all of which create a remote thread in chrome.exe, msedge.exe or firefox.exe.

Noise checknot tested

No baseline event covers this rule’s log type (create_remote_thread / windows), so the rule was never evaluated. This is missing data, not a clean result — nothing was checked either way.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Security Datasets — DLL injected into notepad via mavinject.exe
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1056.004, T1055, evaluated against their create_remote_thread events.

Share this rule

/u/siemphony/3e25d626-50df-4591-91ee-92eb554d0bd8

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Remote thread created inside a credential-handling process

The detection

detection.yml

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Sentinel · KQL

Community

Verdicts from engineers who deployed it