TLDR Tech / InfoSec
Detecting Remote Thread Creation with Windows Driver
S12 walks through how EDRs detect CreateRemoteThread-style injection using PsSetCreateThreadNotifyRoutine, a kernel callback that fires in the creator's context — so comparing PsGetCurrentProcessId() against the notification's ProcessId reliably flags cross-process thread creation. The PoC WDF driver registers the callback in DriverEntry, logs creator/target PID pairs, and filters PID 4 (System) to suppress legitimate kernel-initiated threads. Defenders building on this should layer in thread start-address inspection (unbacked memory, non-image regions), creator process reputation, and correlation with image-load and handle-open callbacks before alerting, since the raw signal alone is noisy.
Read the full story