CreateRemoteThread and LoadLibrary for DLL Injection

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•29

This rule detects the use of the CreateRemoteThread API in conjunction with the LoadLibrary function to inject a DLL into another process. Specifically, it looks for events where a remote thread is created, the starting module is 'kernel32.dll', and the starting function is 'LoadLibraryA'. This combination is a common technique for dynamic-link library (DLL) injection, often used by malware to execute arbitrary code within the context of a legitimate process, evade defenses, and potentially elevate privileges.