Method IsCreateRemoteThread

pkg/event/event_windows.go:279–281

IsCreateRemoteThread indicates if the remote thread creation occurred.

()

// IsCreateRemoteThread indicates if the remote thread creation occurred.
func (e *Event) IsCreateRemoteThread() bool {
	return e.Type == CreateThread && e.PID != e.Params.MustGetPid()
}

// IsSurrogateProcess indicates if the process creation event parent id
// differs from the real process parent identifier.