Waiting Thread Hijacking: A Stealthier Version of Thread Execution Hijacking

This research presents Waiting Thread Hijacking (WTH), a stealthy Windows process injection technique that targets waiting threads—commonly from thread pools—and replaces their stack return address to execute implanted shellcode without suspending threads or modifying thread context, thereby reducing EDR triggers tied to APIs like SetThreadContext and APC-based methods. Using common primitives (VirtualAllocEx, WriteProcessMemory, VirtualProtectEx) and only THREAD_GET_CONTEXT access, WTH preserves application stability via a stub that restores registers and returns execution to the original flow, and includes an optional behavior-obfuscation method that splits allocation, write, permission change, and return-pointer overwrite across child processes. A PoC and guidance on identifying suitable threads (e.g., WrQueue) are provided, along with a discussion of detection trade-offs and EDR evasion considerations.