A fresh Windows Server installation (20212 R2), all updates applied. Sysmon v15.15 installed. Literally nothing else was installed/added. Never started a browser, never opened a web page. Only apps used were standard utilities that come with server, i.e. command prompt, server manager, event viewer, etc.
Is it normal to have Sysmon detect CreateRemoteThread twice on the first day of installing it, and than later never again? Is there a scenario or steps in using standard utilities that trigger CreateRemoteThread detection?
Notice "SourceImage - unknown process" in EventData. No other Sysmon event has ever reported unknown process. How much of a red flag is this?
Event data from first occurrence:
UtcTime 2024-08-08 18:02:08.756
SourceProcessGuid {18B922F1-BBF4-66B4-0500-000000001400}
SourceProcessId 392
SourceImage <unknown process>
TargetProcessGuid {18B922F1-BC01-66B4-1100-000000001400}
TargetProcessId 812
TargetImage C:\Windows\System32\svchost.exe
NewThreadId 1124
StartAddress 0x00007FFF88FCBCC0
StartModule C:\Windows\system32\KERNELBASE.dll
StartFunction CtrlRoutine
SourceUser NT AUTHORITY\SYSTEM
TargetUser NT AUTHORITY\SYSTEM
Second:
UtcTime 2024-08-08 13:32:11.340
SourceProcessGuid {18B922F1-BBF5-66B4-0700-000000001400}
SourceProcessId 456
SourceImage <unknown process>
TargetProcessGuid {18B922F1-C62F-66B4-F503-000000001400}
TargetProcessId 228
TargetImage C:\Windows\system32\cmd.exe
NewThreadId 164
StartAddress 0x00007FFF88FCBCC0
StartModule C:\Windows\system32\KERNELBASE.dll
StartFunction CtrlRoutine
SourceUser NT AUTHORITY\SYSTEM
TargetUser W102\Administrator
