Remote Thread Creation Ttdinject.exe Proxy

Title: Remote Thread Creation Ttdinject.exe Proxy
Status: test
Description:Detects a remote thread creation of Ttdinject.exe used as proxy
References:
  -https://lolbas-project.github.io/lolbas/Binaries/Ttdinject/
Author: frack113
Date: 2022-05-16
modified:2022-06-02
Tags:

• -'attack.execution'
• -'attack.stealth'
• -'attack.t1127'

Logsource:

• product: windows
• category: create_remote_thread

Detection:
  selection:
    SourceImage|endswith: '\ttdinject.exe'
  condition:selection
Falsepositives:
  -Unknown
Level: high