Log Dejargonizer

Sysmon · Event 8

Sysmon Event 8: A thread was created in another process

One process started a thread inside another — the classic shape of code injection. Legitimate software does this, but rarely, which makes the event unusually low-volume and unusually informative for what it costs.

Also written as Sysmon 8Sysmon Event ID 8CreateRemoteThreadSysmon remote thread

What it means for you

On a personal computer

Only present if you installed Sysmon. It records a technique programs use to run code inside each other.

For an analyst

One of the cheapest high-value Sysmon events, because the baseline is genuinely small. Antivirus products, some debuggers, and a handful of Windows components account for nearly all legitimate hits. Note that many modern injection techniques avoid CreateRemoteThread specifically to evade this event, so its absence proves nothing.

What it looks like

Sanitised. Addresses come from the RFC 5737 documentation ranges.

Sample
CreateRemoteThread detected:
  RuleName: -
  UtcTime: 2026-08-28 09:16:02.771
  SourceProcessGuid: {a1b2c3d4-0000-0000-0000-00000000abcd}
  SourceProcessId: 7412
  SourceImage: C:\Users\jbrooks\AppData\Local\Temp\wh.exe
  TargetProcessGuid: {a1b2c3d4-0000-0000-0000-00000000beef}
  TargetProcessId: 4188
  TargetImage: C:\Windows\explorer.exe
  NewThreadId: 9012
  StartAddress: 0x00000210F1C20000
  StartModule: -
  StartFunction: -

The fields that decide it

Everything else in the log line is context.

SourceImage
The process creating the thread — the injector.
TargetImage
The process receiving it — the host.
StartAddress
Where the new thread begins executing. An address not backed by a named module suggests injected code.
StartModule
The module containing the start address, when there is one. An empty value is itself a signal.
StartFunction
The function name, when it can be resolved.
  • LoadLibraryA or LoadLibraryWClassic DLL injection.
  • An empty valueNo resolvable function, which points at shellcode rather than a library.

Ordinary reasons this happens

Most of the time it is one of these.

  • Antivirus and endpoint security products injecting monitoring components, which is most of the legitimate volume.
  • Debuggers attaching to a process.
  • Some Windows components and accessibility software.
  • Application compatibility shims.
  • Performance monitoring and profiling tools.

When it is not ordinary

Classic DLL injection into a running process.

What gives it awayA StartFunction of LoadLibraryA or LoadLibraryW from a process that is not a security product.

ATT&CK T1055.001

Shellcode injected into a legitimate process.

What gives it awayA StartAddress with no backing module and no resolvable function name.

ATT&CK T1055

Injection into a browser or trusted process to bypass network controls.

What gives it awayA target such as a browser or explorer.exe from an unexpected source process.

ATT&CK T1055.012

Credential access preparation.

What gives it awayInjection into a process that holds credentials, followed by process access events against lsass.

ATT&CK T1003

What to do next

  1. Read the source and target pair. The relationship is what matters.
  2. Check whether the source is a known security product, verified by full path.
  3. Look at StartModule and StartFunction — empty values point at shellcode.
  4. Join on ProcessGuid to see the source process's command line and parent.
  5. Check for Sysmon Event 10 from the same source, which often follows.
  6. Check how widely the same pairing appears. Security software will be everywhere.

Queries to run

kql Low enough volume in most environments to read in full once the security agents are excluded. 
Event | where Source == 'Microsoft-Windows-Sysmon' and EventID == 8 | project TimeGenerated, Computer, SourceImage, TargetImage, StartModule, StartFunction | order by TimeGenerated desc
kql Shellcode and classic DLL injection together. 
Event | where Source == 'Microsoft-Windows-Sysmon' and EventID == 8 | where isempty(StartModule) or StartFunction in ('LoadLibraryA','LoadLibraryW') | project TimeGenerated, Computer, SourceImage, TargetImage, StartAddress, StartFunction
splunk 
index=sysmon EventCode=8 | stats count by SourceImage TargetImage | sort count asc

Common questions

Is Sysmon Event 8 always malicious?

No. Antivirus and endpoint security products inject monitoring components into processes as part of normal operation, and debuggers and some Windows components do too. What makes it useful is that the legitimate set is small enough to enumerate — once you have excluded your security agents by path, most of what remains deserves a look.

Why is StartModule empty in Sysmon Event 8?

Because the thread starts at an address that is not inside any loaded module, which usually means the code was written directly into the target's memory. That is a strong indicator of shellcode injection rather than a library being loaded normally.

Do all process injection techniques trigger Sysmon Event 8?

No, and this is important. Event 8 fires specifically on CreateRemoteThread, and many modern techniques deliberately avoid it — thread hijacking, APC injection, and process hollowing among them. Absence of Event 8 is not evidence that no injection happened.

Read next

Vendor documentation

Last reviewed 28 August 2026