This rule detects tools that misuse NtCreateThreadEx and RtlQueryDepthSList to create a remote memory read primitive without using ReadProcessMemory, focusing on thread exit codes for data collection.
S12cybersecurity