Data Source: Sysmon EventID 8

Date: 2025-07-10

ID: df7a786c-ade0-48f0-8596-26f10d169f7d

Author: Patrick Bareiss, Splunk

Description

Logs the creation of a new thread in a process, including details about the thread ID, start address, and source process.

Details

Property	Value
Source	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sourcetype	`XmlWinEventLog`
Separator	EventID

Name ▲▼	Technique ▲▼	Type ▲▼
Create Remote Thread In Shell Application	Process Injection	TTP
Create Remote Thread into LSASS	LSASS Memory	TTP
Powershell Remote Thread To Known Windows Process	Process Injection	TTP
Rundll32 Create Remote Thread To A Process	Process Injection	TTP
Rundll32 CreateRemoteThread In Browser	Process Injection	TTP
Windows Process Injection Of Wermgr to Known Browser	Dynamic-link Library Injection	TTP
Windows Process Injection Remote Thread	Portable Executable Injection	TTP
Windows Process Injection With Public Source Path	Portable Executable Injection	Hunting

Supported Apps

Splunk Add-on for Sysmon (version 5.0.0)

Event Fields

+ Fields

  <span class="pill kill-chain">_time</span>
  
  <span class="pill kill-chain">Channel</span>
  
  <span class="pill kill-chain">Computer</span>
  
  <span class="pill kill-chain">EventChannel</span>
  
  <span class="pill kill-chain">EventCode</span>
  
  <span class="pill kill-chain">EventData_Xml</span>
  
  <span class="pill kill-chain">EventDescription</span>
  
  <span class="pill kill-chain">EventID</span>
  
  <span class="pill kill-chain">EventRecordID</span>
  
  <span class="pill kill-chain">Guid</span>
  
  <span class="pill kill-chain">Keywords</span>
  
  <span class="pill kill-chain">Level</span>
  
  <span class="pill kill-chain">Name</span>
  
  <span class="pill kill-chain">NewThreadId</span>
  
  <span class="pill kill-chain">Opcode</span>
  
  <span class="pill kill-chain">ProcessID</span>
  
  <span class="pill kill-chain">RecordID</span>
  
  <span class="pill kill-chain">RecordNumber</span>
  
  <span class="pill kill-chain">RuleName</span>
  
  <span class="pill kill-chain">SecurityID</span>
  
  <span class="pill kill-chain">SourceImage</span>
  
  <span class="pill kill-chain">SourceProcessGuid</span>
  
  <span class="pill kill-chain">SourceProcessId</span>
  
  <span class="pill kill-chain">StartAddress</span>
  
  <span class="pill kill-chain">StartFunction</span>
  
  <span class="pill kill-chain">StartModule</span>
  
  <span class="pill kill-chain">SystemTime</span>
  
  <span class="pill kill-chain">System_Props_Xml</span>
  
  <span class="pill kill-chain">TargetImage</span>
  
  <span class="pill kill-chain">TargetProcessGuid</span>
  
  <span class="pill kill-chain">TargetProcessId</span>
  
  <span class="pill kill-chain">Task</span>
  
  <span class="pill kill-chain">ThreadID</span>
  
  <span class="pill kill-chain">TimeCreated</span>
  
  <span class="pill kill-chain">UserID</span>
  
  <span class="pill kill-chain">UtcTime</span>
  
  <span class="pill kill-chain">Version</span>
  
  <span class="pill kill-chain">action</span>
  
  <span class="pill kill-chain">date_hour</span>
  
  <span class="pill kill-chain">date_mday</span>
  
  <span class="pill kill-chain">date_minute</span>
  
  <span class="pill kill-chain">date_month</span>
  
  <span class="pill kill-chain">date_second</span>
  
  <span class="pill kill-chain">date_wday</span>
  
  <span class="pill kill-chain">date_year</span>
  
  <span class="pill kill-chain">date_zone</span>
  
  <span class="pill kill-chain">dest</span>
  
  <span class="pill kill-chain">dvc_nt_host</span>
  
  <span class="pill kill-chain">event_id</span>
  
  <span class="pill kill-chain">eventtype</span>
  
  <span class="pill kill-chain">host</span>
  
  <span class="pill kill-chain">id</span>
  
  <span class="pill kill-chain">index</span>
  
  <span class="pill kill-chain">linecount</span>
  
  <span class="pill kill-chain">os</span>
  
  <span class="pill kill-chain">parent_process_exec</span>
  
  <span class="pill kill-chain">parent_process_guid</span>
  
  <span class="pill kill-chain">parent_process_id</span>
  
  <span class="pill kill-chain">parent_process_name</span>
  
  <span class="pill kill-chain">parent_process_path</span>
  
  <span class="pill kill-chain">process_exec</span>
  
  <span class="pill kill-chain">process_guid</span>
  
  <span class="pill kill-chain">process_id</span>
  
  <span class="pill kill-chain">process_name</span>
  
  <span class="pill kill-chain">process_path</span>
  
  <span class="pill kill-chain">punct</span>
  
  <span class="pill kill-chain">signature</span>
  
  <span class="pill kill-chain">signature_id</span>
  
  <span class="pill kill-chain">source</span>
  
  <span class="pill kill-chain">sourcetype</span>
  
  <span class="pill kill-chain">splunk_server</span>
  
  <span class="pill kill-chain">src_address</span>
  
  <span class="pill kill-chain">src_function</span>
  
  <span class="pill kill-chain">src_module</span>
  
  <span class="pill kill-chain">tag</span>
  
  <span class="pill kill-chain">tag::eventtype</span>
  
  <span class="pill kill-chain">timeendpos</span>
  
  <span class="pill kill-chain">timestartpos</span>
  
  <span class="pill kill-chain">user_id</span>
  
  <span class="pill kill-chain">vendor_product</span>
  
</div>

Example Log

1<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385F-C22A-43E0-BF4C-06F5698FFBD9}'/><EventID>8</EventID><Version>2</Version><Level>4</Level><Task>8</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2022-10-27T13:59:12.440938600Z'/><EventRecordID>362233</EventRecordID><Correlation/><Execution ProcessID='2656' ThreadID='2360'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>win-dc-ctus-attack-range-487.attackrange.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>-</Data><Data Name='UtcTime'>2022-10-27 13:59:12.427</Data><Data Name='SourceProcessGuid'>{3381F800-8EB0-635A-1306-000000008A02}</Data><Data Name='SourceProcessId'>4864</Data><Data Name='SourceImage'>C:\Windows\SysWOW64\wermgr.exe</Data><Data Name='TargetProcessGuid'>{3381F800-8085-635A-2701-000000008A02}</Data><Data Name='TargetProcessId'>5572</Data><Data Name='TargetImage'>C:\Windows\System32\Taskmgr.exe</Data><Data Name='NewThreadId'>4964</Data><Data Name='StartAddress'>0x0000000000C20000</Data><Data Name='StartModule'>-</Data><Data Name='StartFunction'>-</Data></EventData></Event>

Required Output Fields

dest
parent_process_exec
parent_process_guid
parent_process_id
parent_process_name
parent_process_path
process_exec
process_guid
process_id
process_name
process_path
signature
signature_id
user_id
vendor_product

Source: GitHub | Version: 3