Process spawned via remote thread
Identifies the creation of a process with the parent call stack not revealing normal API functions for process creation. This may be a sign of process injection.
- Platform: Windows
- Severity: High
- MITRE Tactic: Defense Evasion
- MITRE Techniques: T1055