Module 1: Process Injection Landscape

Classic injection techniques, why they fail against modern EDRs, and the motivation behind PoolParty’s thread pool approach.

1. What Is Process Injection?

Process injection is the act of executing arbitrary code within the address space of a separate, running process. Attackers use it to:

• Evade detection — code runs under a legitimate process name (e.g., svchost.exe, explorer.exe)
• Bypass security boundaries — inherit the target process’s tokens, privileges, and network access
• Persist stealthily — no new process created, no suspicious command lines logged
• Access process-specific resources — read credentials from LSASS, manipulate browser memory

MITRE ATT&CK catalogs process injection under T1055, with over a dozen sub-techniques. Despite decades of research, injection remains a cornerstone of offensive tradecraft because executing code in another process is fundamentally useful.

2. Classic Injection Techniques

2.1 DLL Injection via CreateRemoteThread

The oldest and most well-known technique. The attacker writes the path of a malicious DLL into the target process and creates a remote thread that calls LoadLibraryA:

C++// Classic DLL Injection - highly detected
HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, targetPid);

// Allocate memory in target for DLL path
LPVOID remoteBuf = VirtualAllocEx(hProcess, NULL, dllPathLen,
                                   MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);

// Write DLL path into target process
WriteProcessMemory(hProcess, remoteBuf, dllPath, dllPathLen, NULL);

// Create remote thread calling LoadLibraryA with our DLL path
HANDLE hThread = CreateRemoteThread(hProcess, NULL, 0,
    (LPTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandleA("kernel32.dll"),
                                           "LoadLibraryA"),
    remoteBuf, 0, NULL);

2.2 Shellcode Injection via VirtualAllocEx + WriteProcessMemory

Instead of a DLL path, raw shellcode is written to allocated memory with executable permissions:

C++// Shellcode injection - allocate RWX, write, execute
LPVOID remoteBuf = VirtualAllocEx(hProcess, NULL, shellcodeLen,
                                   MEM_COMMIT | MEM_RESERVE,
                                   PAGE_EXECUTE_READWRITE);

WriteProcessMemory(hProcess, remoteBuf, shellcode, shellcodeLen, NULL);

CreateRemoteThread(hProcess, NULL, 0,
    (LPTHREAD_START_ROUTINE)remoteBuf, NULL, 0, NULL);

2.3 APC Injection

Asynchronous Procedure Calls queue code to execute in the context of a specific thread. The target thread must enter an alertable wait state for the APC to fire:

C++// APC injection - queue shellcode as APC to alertable thread
LPVOID remoteBuf = VirtualAllocEx(hProcess, NULL, shellcodeLen,
                                   MEM_COMMIT | MEM_RESERVE,
                                   PAGE_EXECUTE_READWRITE);
WriteProcessMemory(hProcess, remoteBuf, shellcode, shellcodeLen, NULL);

// Queue APC to each thread in the target process
QueueUserAPC((PAPCFUNC)remoteBuf, hThread, 0);

2.4 Other Variants

3. The API Call Pattern Problem

Every classic injection technique follows the same fundamental three-step pattern that EDRs exploit for detection:

This pattern — allocate, write, execute — is the Achilles’ heel of all traditional injection. EDRs monitor every step:

4. How EDRs Hook These APIs

Modern EDRs use multiple hooking layers to intercept injection-related API calls:

4.1 User-Mode Hooks (ntdll.dll)

EDRs patch the prologue of ntdll.dll functions with a JMP to their monitoring DLL. When your code calls NtAllocateVirtualMemory, execution is redirected to the EDR first:

ASM; Original ntdll!NtAllocateVirtualMemory
mov r10, rcx
mov eax, 18h              ; syscall number
syscall
ret

; After EDR hooking
jmp edr_monitor.dll+0x1234  ; redirected to EDR
nop
nop
syscall                     ; never reached via normal path
ret

4.2 Kernel Callbacks

Windows provides kernel-mode callback mechanisms that EDR drivers register for:

• PsSetCreateProcessNotifyRoutine — notified on process creation
• PsSetCreateThreadNotifyRoutine — notified on thread creation (catches CreateRemoteThread)
• ObRegisterCallbacks — intercepts handle operations (catches OpenProcess)
• ETW TI (Threat Intelligence) — kernel telemetry on memory operations

4.3 ETW (Event Tracing for Windows)

The Microsoft-Windows-Threat-Intelligence ETW provider reports on cross-process memory operations directly from the kernel, bypassing any user-mode unhooking attempts.

5. Why Traditional Techniques Are Failing

The detection landscape has matured to the point where classic injection is reliably caught:

6. PoolParty’s Approach

Alon Leviev’s research (SafeBreach Labs, Black Hat EU 2023) identified a fundamentally different injection surface: the Windows Thread Pool. Instead of creating a remote thread or queuing an APC, PoolParty injects work items into the target process’s thread pool. The thread pool’s own worker threads then execute the callback — no CreateRemoteThread, no QueueUserAPC, no SetThreadContext.

The 8 PoolParty variants each target a different thread pool entry point:

7. Course Roadmap