Remote memory write handle without remote-thread rights

Siemphony@siemphonymediumT1055.003unverified

AN0822 describes a chain of OpenThread, SuspendThread, VirtualAllocEx, WriteProcessMemory, SetThreadContext and ResumeThread against a live process. Only one link in that chain reaches a log source in this brief: the process handle the injector must hold before it can allocate and write, which Sysmon EventID 10 records with its access mask. The rule therefore matches handles granting memory operation and remote memory write on one of the long-lived hosts an injector picks, and deliberately matches only masks that do NOT include PROCESS_CREATE_THREAD — an actor who intends to redirect a thread that already exists has no reason to ask for the right to create one, and that absence is the only thing on this feed that separates thread hijacking from the remote-thread injection published at T1055.001 and T1055.002. The mask list and the target list are authored here; MITRE names the knobs (TargetProcessList, populated here with the shell, session and service hosts, plus TimeWindow and SuspiciousThreadContextRegions, neither of which is expressible without correlation). Limits worth knowing before you trust a quiet result: Sysmon's ProcessAccess callback covers process objects only, so OpenThread, SuspendThread and SetThreadContext produce no event at all, and create_remote_thread (EventID 8) is listed in this brief but is the wrong feed here by construction — this technique reuses an existing thread rather than creating one, so a selector on EventID 8 could never fire for it. An injector that asks for full access (0x1FFFFF) is also missed here and lands in the T1055.001 mask list instead. Prerequisite: Sysmon emits EventID 10 only where the configuration carries a ProcessAccess rule, and the common baseline configurations scope that to lsass.exe alone — on such a host this rule returns zero rows, and zero rows reads as quiet when it means blind. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0295, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 3 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Splunk · SPL

Run this as a search.

index=* ((TargetImage="*\\explorer.exe" OR TargetImage="*\\svchost.exe" OR TargetImage="*\\dllhost.exe" OR TargetImage="*\\taskhostw.exe" OR TargetImage="*\\winlogon.exe" OR TargetImage="*\\spoolsv.exe") AND (GrantedAccess="0x1438" OR GrantedAccess="0x1428" OR GrantedAccess="0x438" OR GrantedAccess="0x428" OR GrantedAccess="0x38" OR GrantedAccess="0x28"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(TargetImage) LIKE "*\\\\explorer.exe" OR TO_LOWER(TargetImage) LIKE "*\\\\svchost.exe" OR TO_LOWER(TargetImage) LIKE "*\\\\dllhost.exe" OR TO_LOWER(TargetImage) LIKE "*\\\\taskhostw.exe" OR TO_LOWER(TargetImage) LIKE "*\\\\winlogon.exe" OR TO_LOWER(TargetImage) LIKE "*\\\\spoolsv.exe") AND (TO_LOWER(GrantedAccess) == "0x1438" OR TO_LOWER(GrantedAccess) == "0x1428" OR TO_LOWER(GrantedAccess) == "0x438" OR TO_LOWER(GrantedAccess) == "0x428" OR TO_LOWER(GrantedAccess) == "0x38" OR TO_LOWER(GrantedAccess) == "0x28"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_access,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="TargetImage" type="pcre2">(?i)(\\explorer\.exe$|\\svchost\.exe$|\\dllhost\.exe$|\\taskhostw\.exe$|\\winlogon\.exe$|\\spoolsv\.exe$)</field>    <field name="GrantedAccess" type="pcre2">(?i)(^0x1438$|^0x1428$|^0x438$|^0x428$|^0x38$|^0x28$)</field>    <description>Remote memory write handle without remote-thread rights</description>    <mitre>      <id>T1055.003</id>    </mitre>  </rule></group>

Sentinel · KQL

Run this as a search.

Sentinel cannot express this construct. No Sentinel table is modelled for this logsource ({"category":"process_access","product":"windows"}), so there is nothing honest to query. Pick a logsource this translator maps, or write the KQL by hand. The Sigma source is on the first tab, unchanged.

At a glance

Logsource: process_access / windows
Level: medium
Category: process_injection
Sigma status: experimental
Backends: 3 of 4 rendered
Updated: 30 Aug 2026
Rule ID: b927cdb6-59b1-4468-bd9f-922b8c55b074

ATT&CKT1055.003

T1055.003Thread Execution Hijacking

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonprocess injection

process injectionAI draft — unreviewed

01 · What this rule detects

MITRE's AN0822 describes a chain: OpenThread, SuspendThread, VirtualAllocEx, WriteProcessMemory, SetThreadContext, ResumeThread. Only one link in it reaches a log source in this brief — the process handle the injector must hold before it can allocate and write. Sysmon EventID 10 records that handle with its access mask, so the rule matches on the handle and infers the rest. Read a hit accordingly. This is a remote-memory-write detector that includes thread hijacking, not a rule specific to it. APC injection (T1055.004) opens its target with exactly the same process rights and takes the thread through OpenThread and QueueUserAPC, producing an identical EventID 10 record. Every mask in the list matches an APC injector as readily as a thread hijacker.

02 · Telemetry you need

The logsource is category: process_access, product: windows, copied from the brief. The prerequisite here is the one that matters most: Sysmon emits EventID 10 only where the configuration carries a ProcessAccess rule, and the widely used baseline configs scope that to lsass.exe alone. None of this rule's six targets are covered by those baselines, so on a stock deployment the rule is structurally silent — it returns zero rows because nothing is being logged, not because nothing happened. Extend the ProcessAccess section to the target list before you conclude anything from a quiet console.
Sysmon's ProcessAccess callback also covers process objects only, so OpenThread, SuspendThread and SetThreadContext produce no event at all.

03 · How the logic works

Two blocks, ANDed. selection_target matches TargetImage|endswith against six long-lived hosts — \explorer.exe, \svchost.exe, \dllhost.exe, \taskhostw.exe, \winlogon.exe, \spoolsv.exe. selection_write matches GrantedAccess against six exact masks — 0x1438, 0x1428, 0x438, 0x428, 0x38, 0x28 — each of which grants VM_OPERATION plus VM_WRITE and, critically, omits PROCESS_CREATE_THREAD (0x2). That omission is the whole discriminator. An actor redirecting a thread that already exists has no reason to request the right to create one, and the absence is the only thing on this feed separating this from the remote-thread injection published at T1055.001 and T1055.002. It does not separate it from T1055.004. Both lists are authored by this pipeline. MITRE names TargetProcessList, populated here with the shell, session and service hosts; MITRE's TimeWindow, SuspiciousThreadContextRegions and ParentProcessAnomalyThreshold knobs are not expressible without correlation. Note the perverse edge: an injector that asks for PROCESS_ALL_ACCESS (0x1FFFFF) drops out of this rule entirely, so the sloppiest tooling escapes this classification. The six-process list is a starting scope too — a hijack into a browser, RuntimeBroker.exe or your own EDR agent produces no match.

04 · Common false positives

The dominant source is hooking and application-compatibility frameworks: Detours-style shim engines, licence and DRM wrappers, anti-cheat clients. They patch a trampoline into a running shell or service host with exactly a VM_OPERATION plus VM_WRITE handle and no create-thread rights, on every launch. Behind them: endpoint protection and DLP agents writing hook stubs into svchost.exe, and accessibility software, IMEs and remote-support products writing into explorer.exe. That first entry is why the rule ships at level: medium rather than higher.
The rule also lists debuggers as a fourth false positive; treat that one with suspicion, since a debugger takes a DEBUG-rights or full-access mask that is not in this list.

05 · Detection maturity

tier_1: Lowest tier. Never executed against a log line, never counted against a real EventID 10 stream, and dependent on a Sysmon config change most estates have not made. Scaffold to validate, not a detection to trust.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Tune on SourceImage, not on the target list. Every legitimate population above comes from a small, stable set of source binaries per estate, and excluding those preserves coverage. Trimming targets or masks only widens the blind spot. On an estate that can carry the volume, invert the gate: any TargetImage, filtered by known-good SourceImage.

Declared by the author

Hooking and application-compatibility frameworks, which are the dominant source and the reason this rule is not rated higher. Detours-style shim engines, licence and DRM wrappers and anti-cheat clients patch a trampoline into a running shell or service host by opening exactly a memory-operation plus memory-write handle and never asking for create-thread rights, and they do it on every launch of the wrapped application.
Endpoint protection, DLP and application-control agents that write configuration blobs or hook stubs into svchost.exe and explorer.exe from their own service. These come from a small, stable set of SourceImage values per estate, which is where the exclusion belongs.
Accessibility software, input-method editors and shell-extension hosts that write into explorer.exe to install a UI hook, plus screen-recording and remote-support products doing the same to capture the desktop.
Debuggers and live memory editors attached to a service host by a developer or by an automated hang investigation, which request query, read and write rights against the process under analysis without creating a thread in it.

Noise check0 of 1 fired

The baseline holds exactly one ordinary behaviour for this log type, and the rule does not fire on it. One event is close to no evidence: this says the rule is not caught by that one behaviour, and nothing more.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1055.003, evaluated against their process_access events.

Share this rule

/u/siemphony/b927cdb6-59b1-4468-bd9f-922b8c55b074

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Remote memory write handle without remote-thread rights

The detection

detection.yml

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Sentinel · KQL

Community

Verdicts from engineers who deployed it