SafeBreach-Labs/PoolParty

Health v2 · maintenance only

Adoption not part of the score

1284 stars · 179 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

PoolParty is a C++ command-line tool implementing eight novel, fully-undetectable process injection techniques that abuse Windows Thread Pools, presented at Black Hat EU 2023. It injects shellcode into a target process by overwriting worker factory start routines or inserting crafted thread pool work items (TP_WORK, TP_WAIT, TP_IO, TP_ALPC, TP_JOB, TP_DIRECT, TP_TIMER).

Use cases

• inject shellcode into a remote process on windows
• test edr detection of process injection techniques
• red team process injection via thread pools
• execute shellcode in a target pid undetected
• research windows thread pool internals
• evaluate security tooling against new injection variants

When to choose

• you need cutting-edge thread pool-based injection for red team or detection research on windows
• you want to benchmark EDR/AV coverage against the eight PoolParty variants

When to avoid

• you need a stealth tool for unauthorized access - this is a research/offensive-security demonstration
• you target non-Windows platforms or need cross-platform injection
• you want a maintained general-purpose injection framework rather than a proof-of-concept

Facets

cli-tool · maturity active

security penetration-testing cli security penetration-testing windows windows cli cpp process-injection thread-pools red-team offensive-security shellcode evasion

Member repositories

For agents

markdown · JSON · MCP: product_card(name="SafeBreach-Labs/PoolParty")