SharpParty: Process Injection in C#

The report presents Stroz Friedberg’s SharpParty, a C# port of SafeBreach Labs’ PoolParty process-injection techniques that abuse Windows Thread Pools, designed to broaden red team options and support MSBuild-based and in-memory execution. It explains the rationale for a C# implementation, shares testing results showing mixed EDR outcomes (including an initial Microsoft Defender for Endpoint bypass later addressed), and recounts a client engagement where execution succeeded and detections were delayed, underscoring both potential improvements and detection gaps.