From 4235461c0be8cad39e788bd7097f4e88ca1215e7 Mon Sep 17 00:00:00 2001
From: S12cybersecurity <79543461+S12cybersecurity@users.noreply.github.com>
Date: Mon, 22 Dec 2025 12:41:51 +0100
Subject: [PATCH] Create Win_ProcInj_ThreadNameCalling_General.yar

---
 Win_ProcInj_ThreadNameCalling_General.yar | 39 +++++++++++++++++++++++
 1 file changed, 39 insertions(+)
 create mode 100644 Win_ProcInj_ThreadNameCalling_General.yar

diff --git a/Win_ProcInj_ThreadNameCalling_General.yar b/Win_ProcInj_ThreadNameCalling_General.yar
new file mode 100644
index 0000000..a79363b
--- /dev/null
+++ b/Win_ProcInj_ThreadNameCalling_General.yar
@@ -0,0 +1,39 @@
+rule Win_ProcInj_ThreadNameCalling_General {
+    meta:
+        author = "0x12 Dark Development"
+        description = "Detects process injection tools or malware using the Thread Name-Calling technique (abusing SetThreadDescription/GetThreadDescription + APC for remote code transfer/execution)"
+        date = "2025-12-22"
+        reference = "https://research.checkpoint.com/2024/thread-name-calling-using-thread-name-for-offense/"
+        technique = "T1055 Process Injection - Thread Name Abuse"
+        mitre_att = "T1055"
+        tlp = "WHITE"
+
+    strings:
+        // High-level APIs
+        $api1 = "SetThreadDescription" ascii wide
+        $api2 = "GetThreadDescription" ascii wide
+
+        // Low-level variants (ThreadNameInformation class)
+        $nt1 = "NtSetInformationThread" ascii wide
+        $nt2 = "NtQueryInformationThread" ascii wide
+        $class = { 00 00 00 00 26 00 00 00 } // ThreadNameInformation = 0x26 (little-endian DWORD)
+
+        // APC queuing APIs commonly used in this technique
+        $apc1 = "QueueUserAPC" ascii wide
+        $apc2 = "NtQueueApcThread" ascii wide
+        $apc3 = "NtQueueApcThreadEx" ascii wide
+
+        // Optional: VirtualProtect for making payload executable
+        $vp = "VirtualProtectEx" ascii wide
+
+    condition:
+        // Must be a PE file
+        uint16(0) == 0x5A4D and
+
+        // Core indicators: thread description APIs + APC queuing
+        (1 of ($api*) or all of ($nt*) or $class) and
+        any of ($apc*)
+
+        // Optional boost: presence of remote memory protection change (common after payload transfer)
+        or $vp
+}