relationship_id: REL-2022-0143
name: Process modified Process
contributors:
- Jose Rodriguez @Cyb3rPandaH
- Roberto Rodriguez @Cyb3rWard0g
- Olaf Hartong @olafhartong
attack:
  data_source: process
  data_component: process modification
behavior:
  source: process
  relationship: modified
  target: process
security_events:
- event_id: '8'
  name: CreateRemoteThread.
  platform: windows
  audit_category: CreateRemoteThread
  channel: Microsoft-Windows-Sysmon/Operational
  log_source: Microsoft-Windows-Sysmon
  event_version:
  - '4.32'
- event_id: DeviceEvents
  name: DeviceEvents
  platform: windows
  log_source: Microsoft Defender for Endpoint
  filter_in:
  - ActionType: CreateRemoteThreadApiCall
  event_version:
  - '0'
  - '1'
references:
- https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-8-createremotethread
notes: null