Breach and attack simulation firm SafeBreach has discovered eight new process injection techniques that leverage Windows thread pools to trigger malicious code execution as the result of legitimate actions.
Dubbed Pool Party, the injection variants work across all processes, without limitations, and are fully undetected by leading endpoint detection and response (EDR) solutions, SafeBreach says.
Process injection, the cybersecurity firm explains, typically involves three primitives, for allocating memory on the target process, for writing malicious code to the allocated memory, and for executing the code.
Because EDR solutions base their detection capabilities on the execution primitive, SafeBreach researched the possibility of creating one based on allocation and writing primitives and triggering the execution by a legitimate action.
Eventually, the cybersecurity firm discovered that the Windows user-mode thread pool represents a viable area for process injection, given that all Windows processes have a thread pool by default.
Looking at the thread pool architecture, the firm identified four potential areas that could be abused for process injection, namely the worker factories, which are responsible for managing thread pool worker threads, three types of queues that are associated with three types of supported work items.
The first discovered process injection technique abuses the start routine of worker factories, while the other seven abuse the three queue types: one abuses the task queue, five abuse the I/O completion queue, while the eighth abuses the timer queue.
The firm then tested each of the identified Pool Party variants against five EDR solutions, namely Palo Alto Cortex, SentinelOne EDR, CrowdStrike Falcon, Microsoft Defender for Endpoint, and Cybereason EDR.
“We achieved a 100 percent success rate, as none of the EDRs were able to detect or prevent Pool Party attacks. We reported these findings to each vendor and believe they are making updates to better detect these types of techniques,” SafeBreach says.
The research, the firm notes, proves that, although EDR solutions have evolved to detect known process injection techniques, novel methods that are undetectable can still be developed, potentially with devastating impact.
“Sophisticated threat actors will continue to explore new and innovative methods for process injection, and security tool vendors and practitioners must be proactive in their defense against them,” SafeBreach concludes.
Related: Stealth Techniques Used in ‘Operation Triangulation’ iOS Attack Dissected
Related: Think Like a Criminal: Knowing Popular Attack Techniques to Stop Bad Actors Faster
Related: New Windows Process Injection Can Be Useful for Stealthy Malware
