MovieReaper Shellcode Execution via EtwpCreateEtwThread API
This rule detects the invocation of the undocumented ntdll.dll function 'EtwpCreateEtwThread'. This API call can be abused by adversaries as an alternative to standard thread creation APIs (like CreateThread) to execute shellcode or malicious code in a suspicious process context, often as part of process injection techniques.
Splunk (SPL)
