Security News New ‘Pool Party’ Process Injection Techniques Undetected by EDR Solutions


Thread author
Staff Member
Malware Hunter
Jul 27, 2015
Breach and attack simulation firm SafeBreach has discovered eight new process injection techniques that leverage Windows thread pools to trigger malicious code execution as the result of legitimate actions. Dubbed Pool Party, the injection variants work across all processes, without limitations, and are fully undetected by leading endpoint detection and response (EDR) solutions, SafeBreach says.

Process injection, the cybersecurity firm explains, typically involves three primitives, for allocating memory on the target process, for writing malicious code to the allocated memory, and for executing the code. Because EDR solutions base their detection capabilities on the execution primitive, SafeBreach researched the possibility of creating one based on allocation and writing primitives and triggering the execution by a legitimate action. Eventually, the cybersecurity firm discovered that the Windows user-mode thread pool represents a viable area for process injection, given that all Windows processes have a thread pool by default.
The firm then tested each of the identified Pool Party variants against five EDR solutions, namely Palo Alto Cortex, SentinelOne EDR, CrowdStrike Falcon, Microsoft Defender for Endpoint, and Cybereason EDR. “We achieved a 100 percent success rate, as none of the EDRs were able to detect or prevent Pool Party attacks. We reported these findings to each vendor and believe they are making updates to better detect these types of techniques,” SafeBreach says.

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.