The Pool Party You Will Never Forget: New Process Injection Techniques Using Windows Thread Pools

...In this talk, we will delve into the internals of the Windows user-mode thread pool, a component that seems to have been overlooked by security researchers in the past. Our exploration begins with an introduction to the thread pool architecture, its work item queuing mechanism, and the execution process managed by the scheduler....

By: Alon Leviev

Full Abstract and Presentation Materials:
https://www.blackhat.com/eu-23/briefings/schedule/#the-pool-party-you-will-never-forget-new-process-injection-techniques-using-windows-thread-pools-35446

architecture exploration injection introduction mechanism mode party pool party process process injection researchers security security researchers techniques windows work