Injection

Remote Thread Creation #

Remote thread telemetry records thread creation and selected source or target context.

• Password Dumper Remote Thread in LSASS Sigma

  Detects password dumper activity by monitoring remote thread creation EventID 8 in combination with the lsass.exe process as TargetImage. The process in field Process is the malicious program. A single execution can lead to hundreds of events.

• Potential Credential Dumping Attempt Via PowerShell Remote Thread Sigma

  Detects remote thread creation by PowerShell processes into "lsass.exe"

APC and Thread Context Activity #

APC queue and thread context telemetry includes selected API caller and behavior context.

No rules currently have sufficient source evidence for selection in this section.

Cross Process Memory and API Activity #

Cross process mappings, writes, allocations, and selected API context can support injection analysis.

No rules currently have sufficient source evidence for selection in this section.

Process Image and Module Indicators #

Process image replacement, module and library context, and sensor image modification are indicators.

• Potential Process Hollowing Activity Sigma

  Detects when a memory process image does not match the disk image, indicative of process hollowing.

Window Hook Call Stack Indicators #

Callback, library, and call stack context can indicate window hook execution in a privileged process.

No rules currently have sufficient source evidence for selection in this section.

Defender Reported Remote Actions #

Defender DeviceEvents reports selected remote action alternatives from Office processes.

No rules currently have sufficient source evidence for selection in this section.

Command and Script Indicators #

Command and script text can indicate a requested capability or API combination.

• Mavinject Inject DLL Into Running Process Sigma

  Detects process injection using the signed Windows tool "Mavinject" via the "INJECTRUNNING" flag