HackTool - CACTUSTORCH Remote Thread Creation

Severity: high
Author: @SBousseaden (detection), Thomas Patzke (rule)
Source: upstream

Detects remote thread creation from CACTUSTORCH as described in references.

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1059.005` Command and Scripting Interpreter: Visual Basic, `T1059.007` Command and Scripting Interpreter: JavaScript
Privilege Escalation	`T1055.012` Process Injection: Process Hollowing
Defense Evasion	`T1055.012` Process Injection: Process Hollowing, `T1218.005` System Binary Proxy Execution: Mshta

Event coverage

Provider	Event ID	Title
Sysmon	8	CreateRemoteThread

Stages and Predicates

Stage 1: `selection`

or:
SourceImage|endswith: '\System32\cscript.exe'
SourceImage|endswith: '\System32\mshta.exe'
SourceImage|endswith: '\System32\wscript.exe'
SourceImage|endswith: '\excel.exe'
SourceImage|endswith: '\winword.exe'
StartModule: null
TargetImage|contains: '\SysWOW64\'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.