The Pool Party You Will Never Forget: New Process Injection Techniques Using Windows Thread Pools
summary
Claims eight new, fully undetectable process‑injection techniques that abuse the Windows user‑mode threadpool and a released tool Pool Party tool that implements them. Techniques include duplicating a target’s worker‑factory handle and overwriting its start routine, inserting malicious entries into the task queue, queuing TP notifications to an IO completion port via SetIoCompletion, and inserting timer work items that fire after the attacker exits. Tested against Palo Alto Cortex, SentinelOne, CrowdStrike, Microsoft Defender and Cybereason with a reported 100% success rate across eight variants, demonstrated by credential dumps and silent ransomware.
AI-written summary · about
chapters (15)
- 0:00Research introduction
- 1:10Injection techniques
- 2:52EDR detection approach
- 3:59Windows thread pool
- 6:12Attack surface analysis
- 7:52Abusing worker factories
- 13:03Thread pool queues
- 13:52Regular work items
- 17:28Asynchronous work items
- 23:40Timer work items
- 28:55Pool party tool
- 29:45Live demo
- 30:42Credential dumping
- 32:18Ransomware bypass
- 33:51Conclusions and takeaways
related talks
49mProcess Injection Techniques - Gotta Catch Them All
25mData-Only Pwning Microsoft Windows Kernel
49mLost in Transaction: Process Doppelgänging
48mHacking Exposed: Next-Generation Tactics, Techniques, and Procedures
41mSimulation Hacking, the Good, Bad and the Ugly
30mPPLdump Is Dead. Long Live PPLdump!
38mDirty Vanity: A New Approach to Code Injection & EDR Bypass
21mBattle of Windows Service: A Silver Bullet to Discover File Privilege Escalation Bugs Automatically