feat(windows-etw): add create_remote_thread from thread starts

[Karib0u]

Summary

Follow-up to #485.

Produce Sigma create_remote_thread events from Kernel-Process thread-start records when the ETW header process differs from the payload target process.

Source and measured cost

• Source: Microsoft-Windows-Kernel-Process, thread-start event 3 with keyword 0x20.
• A controlled CreateRemoteThread record identified the source PID in the ETW header and the target PID and thread ID in the payload, together with raw start addresses.
• The idle lab produced 184 thread starts per minute, or 3.07 events per second.
• Processing should consist primarily of bounded, in-memory process and module lookups.
• Microsoft-Windows-Threat-Intelligence was not usable by the elevated non-PPL consumer, so it is not part of this implementation.

Scope

• Enable the Kernel-Process thread keyword and filter to event 3.
• Emit only when the header source PID differs from the payload target PID.
• Resolve source and target through lifetime-aware process state.
• Populate SourceImage, TargetImage, applicable parent and command-line fields, and raw StartAddress without fabricating missing values.
• Add a bounded target-module range lookup for conditional StartModule support.
• Keep StartFunction conditional until bounded PE export resolution exists.
• Expose stream volume, enrichment misses, and event-loss counters.

Example Sigma coverage

Twelve of the fifteen pinned rules can select using source/target identity or raw start address. Examples include:

• Potential CobaltStrike Process Injection.
• Remote Thread Created In KeePass.EXE.
• PowerShell remote thread into lsass.exe.
• Suspicious remote threads targeting shell applications.
• Uncommon or security-relevant source and target images.

Three rules positively require StartModule or StartFunction and remain conditional until the corresponding enrichment is available.

Acceptance criteria

• Controlled local and remote thread starts are distinguished.
• Source PID, target PID, thread ID, and raw start address match the controlled stimulus.
• PID reuse, exit races, startup gaps, missing modules, and unmapped addresses are tested.
• Source and target identity are not inferred from Audit API timing.
• Missing process, module, or function enrichment remains explicit.
• Event volume, processing latency, enrichment misses, and loss counters expose the added thread stream.
• Each of the fifteen pinned rules receives a direct, conditional, or unavailable field-level coverage result.