Skip to main content

TARGET: Thread

info
RequirementsLimitationsConsiderations
Endgame installed on the target hostOnly one host can be targeted at a timeSuspended threads can be resumed by another process
The hostname of the target host
The target Thread Id

TACTIC: Suspend Thread​

Responding To An Alert

The procedures for suspending a thread in response to an Endgame alert is slightly different than targeting a process that is not directly associated with an alert.

  1. From the Endgame web UI, navigate to the Alerts tab on the left-hand pane
  2. Find the alert of interest and click on the respective Process Injection ALERT TYPE entry to get to the Alert Details page
  3. There are 2 ways to choose to suspend a suspicious thread
    • Clicking on Response -> Suspend Thread and choosing the target thread Id of known suspicious threads
    • Opening either the Target Process (or Source Process, whichever has a red ⚠ caution sign) and clicking the 💉 syringe in the Fileless Attacks entry to open the thread injection details
  4. When prompted, confirm the target thread Id and click Yes to suspend the thread
  5. Click on Go to Endpoint to go to the Endpoint Details page
  6. Verify that the newest Suspend Thread response entry under the Activity Timeline says Suspend Thread (Success)

NOTE: If the entry says Suspend Thread (Failed), click on the entry to expand the log message to investigate why the response failed

1 - Target the host​

  1. From the Endgame web UI, navigate to the Endpoints tab on the left-hand pane

  2. Find the hostname of interest and click on the respective ENDPOINT NAME to get to the Endpoint Details page

2 - Target and suspend the thread​

  1. Click on Take Action -> Respond

  2. Click on the Suspend Thread radio button and fill the Thread Id

  3. Click on Create Response

  4. Verify that the Responses successfully launched message appears and click Close

3 - Verify the response results​

  1. Wait for the Activity Timeline under the Endpoint Details on the left-hand pane to update with a REFRESH LIST notification

  2. Click on the REFRESH LIST notification

  3. Verify that the newest Suspend Thread response entry under the Activity Timeline says Suspend Thread (Success)

NOTE: If the entry says Suspend Thread (Failed), click on the entry to expand the log message to investigate why the response failed