Sysmon Event IDs

ID	Event	Hunt value
1	Process Create	Lineage, command line, hash, Process GUID
2	File creation time changed	Timestomping lead
3	Network Connection	Process-to-destination correlation
4 / 5	Sysmon state / process terminated	Collection and process lifecycle
6 / 7	Driver / Image loaded	Driver and DLL provenance
8	CreateRemoteThread	Injection lead; correlate, do not convict
9	RawAccessRead	Raw disk access
10	ProcessAccess	Cross-process access and access rights
11	FileCreate	Drop/write behavior
12 / 13 / 14	Registry create-delete / value set / rename	Configuration and persistence
15	FileCreateStreamHash	Alternate data streams
16	Sysmon configuration changed	Collection tampering/change
17 / 18	Pipe created / connected	IPC and named-pipe correlation
19 / 20 / 21	WMI filter / consumer / binding	WMI persistence
22	DNS query	Process-to-domain correlation
23 / 26	FileDelete archived / detected	Destruction and cleanup
24	Clipboard changed	Clipboard monitoring where configured
25	Process tampering	Hollowing/tampering lead
27 / 28	FileBlockExecutable / FileBlockShredding	Prevented execution or shredding

Injection correlation

Event 1 process created
  → Event 10 cross-process access
  → Event 8 remote thread
  → Event 3 unexpected network activity

Event 8 alone is not proof of injection. Review SourceImage, TargetImage, StartAddress, StartModule, and StartFunction.

Higher interest: a start address exists while module/function are blank or unresolved. The thread may start in dynamically allocated private memory rather than a normal image.

Pivot next: Event 10 access rights, source/target prevalence, lineage, command line, Event 7 image loads, Event 3/22 network activity, and memory telemetry.