Remote Thread Creation In Mstsc.Exe From Suspicious Location

Status: test
Severity: high
Log source: category create_remote_thread, product windows
Author: Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects remote thread creation in the "mstsc.exe" process by a process located in a potentially suspicious location. This technique is often used by attackers in order to hook some APIs used by DLLs loaded by "mstsc.exe" during RDP authentications in order to steal credentials.

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	No specific technique

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 8: CreateRemoteThread

Rule body

title: Remote Thread Creation In Mstsc.Exe From Suspicious Location
id: c0aac16a-b1e7-4330-bab0-3c27bb4987c7
status: test
description: |
    Detects remote thread creation in the "mstsc.exe" process by a process located in a potentially suspicious location.
    This technique is often used by attackers in order to hook some APIs used by DLLs loaded by "mstsc.exe" during RDP authentications in order to steal credentials.
references:
    - https://github.com/S12cybersecurity/RDPCredentialStealer/blob/1b8947cdd065a06c1b62e80967d3c7af895fcfed/APIHookInjectorBin/APIHookInjectorBin/Inject.h#L25
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-07-28
modified: 2024-01-22
tags:
    - attack.credential-access
logsource:
    product: windows
    category: create_remote_thread
detection:
    selection:
        TargetImage|endswith: '\mstsc.exe'
        SourceImage|contains:
            - ':\Temp\'
            - ':\Users\Public\'
            - ':\Windows\PerfLogs\'
            - ':\Windows\Tasks\'
            - ':\Windows\Temp\'
            - '\AppData\Local\Temp\'
    condition: selection
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    TargetImage|endswith: '\mstsc.exe'
    SourceImage|contains:
        - ':\Temp\'
        - ':\Users\Public\'
        - ':\Windows\PerfLogs\'
        - ':\Windows\Tasks\'
        - ':\Windows\Temp\'
        - '\AppData\Local\Temp\'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`SourceImage`	match	`:\Temp\` corpus 2 (sigma 2) `:\Users\Public\` corpus 2 (sigma 2) `:\Windows\PerfLogs\` `:\Windows\Tasks\` `:\Windows\Temp\` `\AppData\Local\Temp\`	`field:"SourceImage" kind:match`
`TargetImage`	ends_with	`\mstsc.exe`	`field:"TargetImage" kind:ends_with value:"\mstsc.exe"`