detect PoolParty injection

[Still34]

Prerequisites

• [x] Put an X between the brackets on this line if you have done all of the following:
  • Checked that your rule idea isn't already filed: search

Summary

A rule that detects PoolParty, a series of injection techniques that abuses Windows Thread Pools for shellcode injection.

Examples

Features

TBD

Additional context

https://www.youtube.com/watch?v=AvBO4f7blew https://www.blackhat.com/eu-23/briefings/schedule/#the-pool-party-you-will-never-forget-new-process-injection-techniques-using-windows-thread-pools-35446

Rule details

Namespace

References

Other rule meta information

[elad-levi-cyberark]

Implementation for the technique SafeBreach-Labs/PoolParty