Remote Thread from Suspicious Folder (Sysmon)

Group by: _time, host, parent_process_name
Source: github.com/anvilogic-forge/armory

Detects potential remote threads created from suspicious file locations like temp, appdata, and downloads

MITRE ATT&CK coverage

Tactic	Techniques
Privilege Escalation	`T1055` Process Injection
Stealth	`T1055` Process Injection

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 8: CreateRemoteThread

Rule body

id: '9020.12093'
title: Remote Thread from Suspicious Folder
description: 'Detects potential remote threads created from suspicious file locations
  like temp, appdata, and downloads. - Threat Actor Association: APT10/menuPass, TA413
  - Software Association: Black Basta, LOWZERO'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (EventCode=8 OR "Event>ID>8<")
  ("Temporary Internet Files" OR TERM("TEMP") OR TERM("Downloads") OR TERM("Appdata"))
  | regex parent_process_path="(?i)Temp|Downloads|Appdata" | table _time, host, user
  dest, direction, event_id, eventtype, parent_*, process, process_*, user, user_id
  | bin span=1s | stats values(*) as * by _time, host, parent_process_path '
techniques:
- defense-evasion:process injection
- privilege-escalation:process injection
technique_id: 
- T1055
data_category:
- Process command-line parameters
- Windows Sysmon
references: null

Stages and Predicates

Stage 1: `search`

`get_endpoint_data` `get_endpoint_data_sysmon` (EventCode=8 OR "Event>ID>8<") ("Temporary Internet Files" OR TERM("TEMP") OR TERM("Downloads") OR TERM("Appdata"))

Stage 2: `regex`

| regex parent_process_path="(?i)Temp|Downloads|Appdata"

Stage 3: `table`

| table _time, host, user dest, direction, event_id, eventtype, parent_*, process, process_*, user, user_id

Stage 4: `bucket`

| bin span=1s

Stage 5: `stats`

| stats values(*) as * by _time, host, parent_process_path

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventCode`	eq	`8` corpus 10 (splunk 9, elastic 1)	`field:"EventID" kind:eq value:"8"`
`parent_process_path`	regex_match	`"(?i)Temp` `Downloads` `Appdata"`	`field:"parent_process_name" kind:regex_match`

Search terms

These SPL tokens match against raw event text.

Stage	Term
1	`"Event>ID>8<"`
1	`"Temporary Internet Files"`
1	`"TEMP"`
1	`"Downloads"`
1	`"Appdata"`