detection.wiki

Detection rules › Sigma

Remote Thread Creation In Mstsc.Exe From Suspicious Location

Status
test
Severity
high
Log source
product windows, category create_remote_thread
Author
Nasreddine Bencherchali (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects remote thread creation in the "mstsc.exe" process by a process located in a potentially suspicious location. This technique is often used by attackers in order to hook some APIs used by DLLs loaded by "mstsc.exe" during RDP authentications in order to steal credentials.

MITRE ATT&CK coverage

TacticTechniques
Credential AccessNo specific technique

Event coverage

ProviderEventTitle
SysmonEvent ID 8CreateRemoteThread

Rule body yaml

title: Remote Thread Creation In Mstsc.Exe From Suspicious Location
id: c0aac16a-b1e7-4330-bab0-3c27bb4987c7
status: test
description: |
    Detects remote thread creation in the "mstsc.exe" process by a process located in a potentially suspicious location.
    This technique is often used by attackers in order to hook some APIs used by DLLs loaded by "mstsc.exe" during RDP authentications in order to steal credentials.
references:
    - https://github.com/S12cybersecurity/RDPCredentialStealer/blob/1b8947cdd065a06c1b62e80967d3c7af895fcfed/APIHookInjectorBin/APIHookInjectorBin/Inject.h#L25
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-07-28
modified: 2024-01-22
tags:
    - attack.credential-access
logsource:
    product: windows
    category: create_remote_thread
detection:
    selection:
        TargetImage|endswith: '\mstsc.exe'
        SourceImage|contains:
            - ':\Temp\'
            - ':\Users\Public\'
            - ':\Windows\PerfLogs\'
            - ':\Windows\Tasks\'
            - ':\Windows\Temp\'
            - '\AppData\Local\Temp\'
    condition: selection
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
    TargetImage|endswith: '\mstsc.exe'
    SourceImage|contains:
        - ':\Temp\'
        - ':\Users\Public\'
        - ':\Windows\PerfLogs\'
        - ':\Windows\Tasks\'
        - ':\Windows\Temp\'
        - '\AppData\Local\Temp\'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
SourceImagematch
  • :\Temp\ corpus 13 (sigma 13)
  • :\Users\Public\ corpus 15 (sigma 15)
  • :\Windows\PerfLogs\
  • :\Windows\Tasks\ corpus 5 (sigma 5)
  • :\Windows\Temp\ corpus 9 (sigma 9)
  • \AppData\Local\Temp\ corpus 11 (sigma 11)
TargetImageends_with
  • \mstsc.exe