FortiEDR coverage: PoolParty Code Injection Technique

What is the Attack?




On December 6, researchers from SafeBreach published a new code injection technique for Windows OS called "Pool Party" in the Blackhat EU briefing.

The "Pool Party" technique allows injecting processes using the WINAPI thread pool and relies on the fact that every process has an automatically enabled thread pool. It then uses the API on the target process to add new routines to the existing thread pool.






Why is this Significant?


The new injection technique implements …

attack blackhat briefing called code code injection december fact fortiedr injection injection technique party pool party process processes researchers safebreach what is winapi windows windows os