uberAgent

Remote Thread Monitoring

July 30, 2024

Contributed by:

uberAgent ESA detects remote thread creation that may be used in malicious attack techniques or suspicious activities such as DLL injections or malicious code execution in remote processes.

Configuration

uberAgent ESA Remote Thread Monitoring is enabled or disabled through a configuration option. The related configuration Stanza is [Miscellaneous].

Configure the setting RemoteThreadMonitoring = false to disable remote thread monitoring.

By default, this option is enabled (requires ESA enabled and Process Startup metrics enabled, too).

Detecting Remote Thread Events

Any remote thread action is queryable with uAQL and its Threat Detection Engine rules.

Example Rule

The following example detects any Remote Thread event and forwards it to your backend, once triggered.

[ActivityMonitoringRule]
# Detect any remote thread creation
RuleName = Detect remote thread creations
EventType = Process.CreateRemoteThread
Query = true
Tag = process-create-remote-thread
RiskScore = 75
GenericProperty1 = Thread.Id
GenericProperty2 = Thread.Timestamp
GenericProperty3 = Thread.StartAddress
GenericProperty4 = Thread.StartModule
GenericProperty5 = Thread.StartFunctionName
<!--NeedCopy-->

However, this general rule may include false positives. There are many cases where remote threads are used that are absolutely not malicious or suspicious. (e.g: debugging applications or OS remote threads)

Therefore it is recommended to filter this with more advanced conditions using Common Event Properties and Remote Event Properties.

uberAgent ESA is shipped with many automatically converted rules from Sigma. This ruleset already includes several useful Remote Thread detection rules.

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Was this helpful

Remote Thread Monitoring

July 30, 2024

Contributed by:

July 30, 2024

Contributed by:

Remote Thread Monitoring

Configuration

Detecting Remote Thread Events

Example Rule

In this article