Breadcrumbs

EVID 8 : Create Remote Thread (Sysmon 7.01)

Event Details

Event Type

CreateRemoteThread

Event Description

8

: Detects when a process creates a thread in another process.

Event ID

8

Log Fields and Parsing

This section details the log fields available in this log message type, along with values parsed for both LogRhythm Default and LogRhythm Default v2.0 policies. A value of "N/A" (not applicable) means that there is no value parsed for a specified log field.

Log Field

LogRhythm Default

LogRhythm Default v2.0

Provider

N/A

N/A

EventID

<vmid>

<vmid>

Version

N/A

N/A

Level

<severity>

<severity>

Task

<vendorinfo>

<vendorinfo>

Opcode

N/A

N/A

Keywords

N/A

<result>

TimeCreated 

N/A

N/A

EventRecordID

N/A

N/A

Correlation 

N/A

N/A

Execution 

N/A

N/A

Channel

N/A

N/A

Computer

<dname>

<dname>

Security 

N/A

N/A

SourceProcessGuid

<session>

N/A

SourceProcessId

<parentprocessid>

<parentprocessid>

SourceImage

<parentprocesspath>, <parentprocessname>

<parentprocessname>

TargetProcessGuid

N/A

N/A

TargetProcessId

<processid>

<processid>

TargetImage

<processpath>, <process>, <subject>

<process>

NewThreadId

N/A

N/A

StartAddress

N/A

N/A

StartModule

N/A

N/A

StartFunction

N/A

N/A

RuleName

N/A

<policy>

UserId

<domain><login>

N/A

Log Processing Settings

This section details log processing changes made from the LogRhythm Default policy to LogRhythm Default v2.0. In some cases, base rules are broken down into sub-rules to appropriately parse log message types by their event types.

LogRhythm Default

Regex ID

Rule Name

Rule Type

Common Events

Classification

1009426

EVID 8 : Create Remote Thread

Base Rule

Process/Service Started

Startup and Shutdown

LogRhythm Default v2.0

Regex ID

Rule Name

Rule Type

Common Events

Classification

1011227

V 2.0 : EVID 8 : Remote Thread Created

Base Rule

Process/Service Started

Startup and Shutdown