Code injection with CreateRemoteThread in a remote process

Hunt Hypothesis

Adversaries may use CreateRemoteThread to inject malicious code into a remote process, allowing them to execute arbitrary code and evade standard detection mechanisms. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify potential code injection attacks that could lead to deeper system compromise.

YARA Rule

rule inject_thread {
    meta:
        author = "x0r"
        description = "Code injection with CreateRemoteThread in a remote process"
	version = "0.1"
    strings:
        $c1 = "OpenProcess"
        $c2 = "VirtualAllocEx"
        $c3 = "NtWriteVirtualMemory"
        $c4 = "WriteProcessMemory"
        $c5 = "CreateRemoteThread"
        $c6 = "CreateThread"
        $c7 = "OpenProcess"
    condition:
        $c1 and $c2 and ( $c3 or $c4 ) and ( $c5 or $c6 or $c7 )
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 7 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: Legitimate remote process management using CreateRemoteThread
  Description: A system administrator uses a tool like Process Explorer or PsExec to debug or manage a remote process, which may involve injecting code for diagnostic purposes.
  Filter/Exclusion: Exclude processes associated with known administrative tools (e.g., Process Explorer, PsExec, DebugDiag) or filter by user context (e.g., Administrators group).

• Scenario: Scheduled job execution with remote code injection
  Description: A scheduled task (e.g., via schtasks.exe) runs a script that uses CreateRemoteThread to inject code into a remote process as part of a legitimate automation workflow.
  Filter/Exclusion: Exclude events related to scheduled tasks by checking the TaskName or Trigger fields in the event log, or filter by the Task Scheduler service.

• Scenario: Debugging a remote process with a debugger tool
  Description: A developer uses a debugger like Visual Studio or WinDbg to attach to a remote process and inject code for debugging or analysis.
  Filter/Exclusion: Exclude processes associated with debugging tools (e.g., devenv.exe, dbgeng.dll, win dbg) or filter by the presence of a debugger attachment signature.

• Scenario: Remote code execution for patching or configuration management
  Description: A configuration management tool (e.g., Chef, Puppet, Ansible) or patching tool (e.g., SCCM, WSUS) uses CreateRemoteThread to apply updates or configure a remote process.
  Filter/Exclusion: Exclude processes associated with configuration management tools or filter by the presence of known patching or configuration management service names.

• **Scenario: Malicious code injection via legitimate