System and method for detecting and monitoring thread creation

An endpoint agent for monitoring thread creation for malicious activity, comprising:

• a communications engine configured to:
• receive a set of rules from a cloud service;
• and
• send creating process data, target process data, and thread data to the cloud service for new threads;
• a thread creation monitor configured to:
• identify the new thread;
• determine a creating process and target process for the new thread;
• compare the creating process and target process to identify a remote thread injection event when the target process and the creating process are different;
• and
• log the creating process data, the target process data, the thread data for the remote thread injection event, and a portion of the data stored at a start address of the thread;
• and
• an inspector configured to:
• compare the remote thread injection event to the set of rules;
• determine if the new thread is allowable including checking a set of protected processes for which no remote thread injection is allowable;
• wherein the set of rules includes a set of protected processes and the inspector is further configured to compare the target process to the set of protected processes and determining the thread is not allowable when the target process is in the set of protected processes;
• and
• terminate the new thread if the thread is not allowable.

A non-transitory computer-readable medium including code that when executed causes a processor to perform a method, the method comprising:

• monitoring a system for creation of a new thread;
• determining the creation of the new thread is a remote thread creation event when a comparison between a target process and a creating process indicates the target process and the creating process are different;
• logging the remote thread creation event including source process information, target process information, and a portion of the data stored at a start address of the thread;
• evaluating the new thread based on a set of rules to determine the thread is malicious or compromised, the set of rules including a set of protected processes for which no remote thread injection is allowable;
• wherein evaluating the new thread includes comparing the target process to a set of protected processes and determining the thread is malicious or compromised when the target process is in the set of protected processes;
• and
• terminating the new thread.