threadless.kql

Sysmon
| where EventID == 10
| extend src = tolower(SourceImage), tgt = tolower(TargetImage)
| extend ga_int = tolong(GrantedAccess)
| extend is_cross = iff(src != tgt, 1, 0)
| extend inject_rights = iff(binary_and(ga_int, 0x28) == 0x28, 1, 0)  
| extend unbacked_call = iff(CallTrace has "UNKNOWN(", 1, 0)
| extend is_trusted = iff(
       src matches regex @"\\(splunkd|csrss|msmpeng|code|sysmon64|procdump|procdump64|enghost)\.exe$"
    or src has @"\windows\system32\" or src has "windbg", 1, 0)
| where is_cross == 1 and inject_rights == 1 and is_trusted == 0
| extend detect_type = "THREADLESS_PROCESS_ACCESS"
| extend confidence = iff(unbacked_call == 1, 0.75, 0.60)
| extend impact = 60
| extend risk_score = impact * confidence
| where risk_score >= 30
| extend Severity = case(risk_score >= 45, "High", risk_score >= 36, "Medium", "Low")
| project TimeGenerated, detect_type, Severity, risk_score, confidence,
          SourceImage, TargetImage, GrantedAccess, CallTrace,
          SourceProcessGuid, TargetProcessGuid
| order by risk_score desc, TimeGenerated desc