8 Sysmon log · CreateRemoteThread high severity low volume

Sysmon Event ID 8 — CreateRemoteThread detected

A process created a thread in another process. SourceImage (injecting), TargetImage (victim), StartAddress, StartFunction are key.

Why event 8 matters

Classic process injection indicator (T1055). Migrating shellcode between processes, injecting into svchost.exe or lsass.exe for stealth. Tools: Metasploit migrate, Cobalt Strike inject, Mimikatz injections. TargetImage=lsass.exe = credential access attempt. Any injection into a system process is high priority.

How to detect it

Alert: TargetImage=lsass.exe from any process. Alert: SourceImage in temp/user directories. Alert: StartFunction contains 'Reflect' or 'Load' (reflective injection). Low volume makes this high-fidelity when Sysmon 8 is enabled.

Log source
Microsoft-Windows-Sysmon/Operational
Requires Sysmon installed with a config that logs this event (e.g. SwiftOnSecurity / Olaf Hartong).
Fields to pivot on
SourceImageTargetImageStartAddress

MITRE ATT&CK mapping

Tactic Technique
Defense Evasion Process Injection (T1055)
Credential Access LSASS Memory (T1003.001)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sigma rule
title: Suspicious Remote Thread Creation
status: stable
description: Process injecting into another process — possible process injection
author: theadminstack.com
date: 2026/05/16
logsource:
    category: create_remote_thread
    product: windows
detection:
    selection:
        TargetImage|endswith:
            - '\\lsass.exe'
            - '\\svchost.exe'
            - '\\winlogon.exe'
    filter_legit:
        SourceImage|startswith:
            - 'C:\\Windows\\System32\\'
            - 'C:\\Windows\\SysWOW64\\'
    condition: selection and not filter_legit
falsepositives:
    - Security software
    - Some legitimate AV products
level: critical
tags:
    - attack.defense_evasion
    - attack.t1055
    - attack.credential_access
Sentinel / Defender KQL
Event
| where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID == 8   // CreateRemoteThread detected
// EventData holds: SourceImage, TargetImage, StartAddress
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated desc
Splunk SPL
index=* sourcetype="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=8
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# CreateRemoteThread detected — add EventData fields: SourceImage, TargetImage, StartAddress`
Hunt event 8 in Sentinel/Defender →
Build a KQL query for this event in the KQL Query Builder.
Search all event IDs →
Open the interactive Windows Event ID lookup.

Frequently asked questions

What is Sysmon Event ID 8?

CreateRemoteThread detected. A process created a thread in another process. SourceImage (injecting), TargetImage (victim), StartAddress, StartFunction are key.

Which log records event 8?

Event 8 is written to the Microsoft-Windows-Sysmon/Operational channel by Microsoft-Windows-Sysmon. Requires Sysmon installed with a config that logs this event (e.g. SwiftOnSecurity / Olaf Hartong).

What MITRE ATT&CK techniques map to event 8?

Event 8 is associated with: Process Injection (T1055), LSASS Memory (T1003.001).

How do you detect activity around event 8?

Alert: TargetImage=lsass.exe from any process. Alert: SourceImage in temp/user directories. Alert: StartFunction contains 'Reflect' or 'Load' (reflective injection). Low volume makes this high-fidelity when Sysmon 8 is enabled.