CreateThread

TLDR: CreateThread creates and starts a new thread in the current process. The thread begins executing at the start of the shellcode stored in the allocated memory.

Executive Summary

CreateThread is a classic for a reason—it’s direct, flexible, and broadly supported, making it a go-to for attackers looking to execute code within the context of the current process. Often paired with VirtualAlloc and WriteProcessMemory for straightforward injection chains, it also appears in stealthier techniques like reflective DLL loading or executing payloads staged in the current process. Its reliability makes it popular across commodity malware, APT toolkits, and red team frameworks. However, defenders have caught on, and its predictability has driven attackers to develop evasive tradecraft: patching the API, using alternatives like NtCreateThread, or avoiding new thread creation entirely. This entry explores how CreateThread works and how attackers adapt it—offering defenders a wider lens to detect what might otherwise go unnoticed.

What is CreateThread?

CreateThread is a Windows API from kernel32.dll that allows a process to create a new thread within its own address space. It’s commonly used to execute code after memory has been allocated and populated, typically via VirtualAlloc and WriteProcessMemory. While it has legitimate uses in applications requiring multi-threading—such as performance optimization or task parallelization—it’s heavily abused in malware and offensive tooling to execute shellcode or load DLLs within the current process. Its presence can signal process injection or dynamic code execution techniques.

Why It Matters

This API is included in the Windows API Abuse Atlas due to its frequent use in process injection, but also because of its versatility in advanced tradecraft. While it’s commonly used to execute shellcode or load DLLs within the current process via VirtualAlloc and WriteProcessMemory, CreateThread also appears in more nuanced techniques—such as triggering reflective DLL loaders directly from memory or executing payloads staged in the current process. Its broad compatibility and reliability make it attractive to both commodity malware and advanced threat actors employing modular or fileless payloads.

How Attackers Abuse It

Beyond standard injection and execution, attackers use CreateThread in subtle ways to evade detection. This includes triggering payloads staged within the current process, allowing malicious code to run under the guise of a trusted application. Some attackers combine CreateThread with thread hijacking, reusing existing threads to minimize the footprint of new thread creation. These variations enhance stealth and complicate detection, making CreateThread a versatile tool in advanced adversary toolkits.