AN0822
Analytic 0822
Windows
Detects hijacking of an existing thread (OpenThread) through a behavioral chain involving thread suspension (SuspendThread), memory modification (VirtualAllocEx + WriteProcessMemory), context manipulation (SetThreadContext), and thread resumption—all within another live process's address space (ResumeThread).
WinEventLog:Sysmon
EventCode=10
WinEventLog:Sysmon
EventCode=8
etw:Microsoft-Windows-Kernel-Process
API Calls
WinEventLog:Sysmon
EventCode=1
[TargetProcessList]
Sensitive processes that should never be targeted for thread hijack attempts
[TimeWindow]
Expected delay between SuspendThread and ResumeThread events; tight thresholds reduce evasion
[SuspiciousThreadContextRegions]
Memory regions or offsets that should not be targeted for SetThreadContext
[ParentProcessAnomalyThreshold]
Score deviation of the parent/child relationship in a thread injection chain