Windows Processes, Nefarious Anomalies, and You: Threads

This blog post details methods to enumerate and analyze Windows threads to find malicious behavior, covering CreateToolhelp32Snapshot/Thread32*, NtQueryInformationThread to get thread start addresses, StackWalk64 and Sym* APIs to build call stacks, and heuristics to detect sleeping threads (e.g., NtDelayExecution) and threads originating from private RWX memory (reflective DLLs). It uses the Maelstrom implant as an example and provides JSON-formatted detection logs and Kibana visualizations.