⬇ Download holy card: ·
Blessed Pool Party, Who Dived Into the Threads
Patron of Windows thread pools, process injection, and the EDRs that never get invited to the party.
Life
In December 2023, at Black Hat Europe, Alon Leviev of SafeBreach presented eight process injection techniques dubbed Pool Party. Instead of the usual tricks, they abused Windows thread pools: by overwriting the start routine of worker factories, or slipping work into the task, timer and I/O queues, code ran in another process through actions that looked entirely legitimate. In testing they bypassed five major EDR products.
Prayer
O Blessed Pool Party, who invites our code into someone else's pool, let our processes run only the work they wrote. Amen.
How to celebrate
Celebrated by updating the EDR's detection rules and remembering that a worker factory should never change its trade.
Leave the pool open and you'll find guests swimming in it.