Product documentation
uberAgent
Select version Current Release 7.2.1 7.2.0 7.1.2 7.1.1 7.1.0 7.0.2 7.0.1 7.0.0

Remote Thread Event Properties

July 9, 2024
Contributed by: 
C

The following event properties can be used with create remote thread events in uAQL queries (event type Process.CreateRemoteThread). In addition to the properties listed here, the common properties are applicable, too.

Property name uAQL Data Type Description
Thread.Id Integer The thread identifier of the newly created thread.
Thread.Timestamp Integer Event Timestamp
Thread.Process.Id Integer The process identifier of the process that runs the newly created thread.
Thread.Parent.Id Integer The process identifier of the process that has initiated the remote thread.
Thread.StartAddress Integer The absolute address in virtual memory where the function is located.
Thread.StartModule String The name of the library where the function that was started is located in.
Thread.StartFunctionName String The name of the function that was started as entry point for the new thread.
Remote Thread Event Properties
July 9, 2024
Contributed by: 
C
July 9, 2024
Contributed by: 
C

In this article

Site feedback | Your privacy choices footer linkYour Privacy Choices | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.