Sysmon Event ID 8: CreateRemoteThread
- Applicable version
- Sysmon 1.0 and later; CreateRemoteThread logging must be enabled
- Last reviewed
- 2026-07-21
Quick summary
Sysmon Event ID 8 records a process creating a thread in another process and is a high-value telemetry source for investigating process injection and cross-process execution.
Technical Metadata
| Event ID | 8 |
|---|---|
| Provider | Microsoft-Windows-Sysmon |
| Channel | Microsoft-Windows-Sysmon/Operational |
| Level | Informational |
| MITRE ATT&CK | TA0005 Defense Evasion / T1055 Process Injection |
| Key fields to watch | SourceImage / SourceProcessGuid, TargetImage / TargetProcessGuid, StartAddress, StartModule / StartFunction |
Trigger Scenarios
Sysmon generates the event when it observes a remote thread creation attempt. The event can be produced by benign debuggers and security tooling as well as by injection techniques.
Key Fields
SourceImage / SourceProcessGuid
The process that created the remote thread. Investigate whether it is expected to interact with the target process and correlate it to Event ID 1.
TargetImage / TargetProcessGuid
The process receiving the new thread. Sensitive targets such as browser, authentication, security, and business application processes deserve role-aware triage.
StartAddress
The thread start address. Addresses in unusual memory regions can support injection analysis, but require memory and module context to interpret correctly.
StartModule / StartFunction
When available, these fields identify the module and exported function associated with the start address. Missing or unexpected module context can be notable.
Threat Hunting Queries
Event
| where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID == 8
| project TimeGenerated, Computer, RenderedDescription
| order by TimeGenerated desc- Data source
- Microsoft Sentinel Event table
- Assumptions
- The Sysmon Operational channel is collected into Event and retains RenderedDescription. Apply the event-specific field and correlation guidance on this page after retrieving the base events.
index=sysmon source="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=8
| table _time, host, user, EventCode, Message- Data source
- Splunk Sysmon event data
- Assumptions
- Index, source, and field aliases vary by Splunk deployment and Windows add-on version. Map provider fields from the raw event before adding event-specific filtering or aggregation.
dataset = microsoft_windows_raw
| filter edr_event_id = 8- Data source
- Cortex XDR microsoft_windows_raw
- Assumptions
- The Sysmon Operational channel is ingested into Cortex XDR. Event ID 8 is not globally unique; confirm Provider is Microsoft-Windows-Sysmon before applying Sysmon field semantics.
title: Sysmon Event ID 8
status: experimental
logsource:
product: windows
service: sysmon
detection:
selection:
EventID: 8
condition: selection
falsepositives:
- Legitimate administrative or system activity
level: informational- Data source
- Sigma Windows Sysmon log source
- Assumptions
- This rule retrieves the event and is not a standalone malicious-behavior detection. Add the field conditions and correlations documented on this page in the destination SIEM.
Documented Values and Codes
| Field | Value | Meaning | Security relevance |
|---|---|---|---|
| StartModule | (empty) | Sysmon could not map the remote thread start address to a loaded module. | An address outside known loaded modules can be consistent with injected memory, but symbol resolution and telemetry limitations must be excluded. Source |
MITRE ATT&CK Mapping
- T1055Process Injection
Detection Notes
T1055 injection is concrete when TargetImage is lsass.exe or explorer.exe and StartModule is empty while SourceImage runs from C:\\Users\\ or C:\\Temp\\. An empty StartModule with a remote StartAddress supports shellcode rather than a normal exported function.
Common False Positives
- Endpoint protection, EDR agents, debuggers, accessibility tools, and application instrumentation may create remote threads.
- Some application frameworks and automation products use cross-process techniques for legitimate integration.
- A single event without the source process, target role, or follow-on behavior is not sufficient to label as malicious.
Related Events
Sample Log
UtcTime: 2026-07-10 03:20:18.000
SourceImage: C:\Users\jsmith\AppData\Local\Temp\updater.exe
TargetImage: C:\Windows\explorer.exe
StartAddress: 0x000001F4A1230000
StartModule:
StartFunction: Frequently Asked Questions
What does Sysmon Event ID 8 mean?
Sysmon Event ID 8 records one process creating a thread in another process and includes source, target, and remote start-address context.
Does CreateRemoteThread always mean process injection?
No. Security, accessibility, debugging, and management software can create remote threads; investigate the source-target pair, signer, path, start module, and surrounding process activity.
Why can StartModule or StartFunction be empty?
Sysmon derives these fields from the start address; they can be empty when the address cannot be resolved to a loaded module or exported function, which is useful but not conclusive injection evidence.
Sources
- Sysmon
Microsoft · vendor
- Process Injection (T1055)
MITRE ATT&CK · attack
- XDR Collector datasets
Palo Alto Networks · vendor
- Sigma Rules Specification
SigmaHQ · detection rule