Ntdll EtwpCreateEtwThread Alternative to CreateThread (Shellcode Exec)
Detects thread creation events where the initiating module is ntdll.dll, bypassing the conventional CreateThread path originating from kernel32.dll. This is a common behavioral indicator of process injection techniques used to hide malicious thread execution.
SentinelOne
