Hannibal Stealer DLL Injection via CreateRemoteThread from .NET Host

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•4

Detects potential process injection attempts by unidentified executable files originating from suspicious directories (AppData or Temp) targeting critical system or service processes (e.g., explorer.exe, svchost.exe). The rule monitors CreateRemoteThread events and excludes signed dotnet host processes, characteristic of Hannibal Stealer behavior.