HackTool - CACTUSTORCH Remote Thread Creation

Title: HackTool - CACTUSTORCH Remote Thread Creation
Status: test
Description:Detects remote thread creation from CACTUSTORCH as described in references.
References:
  -https://twitter.com/SBousseaden/status/1090588499517079552
  -https://github.com/mdsecactivebreach/CACTUSTORCH
Author: @SBousseaden (detection), Thomas Patzke (rule)
Date: 2019-02-01
modified:2023-05-05
Tags:

• -'attack.privilege-escalation'
• -'attack.execution'
• -'attack.stealth'
• -'attack.t1055.012'
• -'attack.t1059.005'
• -'attack.t1059.007'
• -'attack.t1218.005'

Logsource:

• product: windows
• category: create_remote_thread

Detection:
  selection:
    SourceImage|endswith:
      -'\System32\cscript.exe'
      -'\System32\wscript.exe'
      -'\System32\mshta.exe'
      -'\winword.exe'
      -'\excel.exe'

    TargetImage|contains: '\SysWOW64\'
    StartModule: 'None'
  condition:selection
Falsepositives:
  -Unknown
Level: high