Sysmon Event ID 8: CreateRemoteThread
Records one process starting a thread inside another process.
- Log
- Microsoft-Windows-Sysmon/Operational
- Category
- Process injection
Why it matters
- A classic sign of process injection, though a few legitimate tools (and Windows itself) also do it.
What to check
Check SourceImage, TargetImage and StartFunction; injection into explorer.exe, lsass.exe or browsers stands out.
How to turn it on
Sysmon configuration including CreateRemoteThread.
MITRE ATT&CK
- T1055 Process Injection