Remote Thread Creation In Mstsc.Exe From Suspicious Location
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects remote thread creation in the "mstsc.exe" process by a process located in a potentially suspicious location. This technique is often used by attackers in order to hook some APIs used by DLLs loaded by "mstsc.exe" during RDP authentications in order to steal credentials.
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "sa_create_remote_thread" AND PROCESSNAME endswith "\mstsc.exe" AND PARENTPROCESSNAME contains ":\Temp\,:\Users\Public\,:\Windows\PerfLogs\,:\Windows\Tasks\,:\Windows\Temp\,\AppData\Local\Temp" select Action1.HOSTNAME,Action1.MESSAGE,Action1.PROCESSNAME,Action1.PARENTPROCESSNAME
Detection
Execution Mode
realtime
Log Sources
Windows
Author
Nasreddine Bencherchali (Nextron Systems)
