I'd like to know about every possible way how a thread can be created in a process at the lowest possible level.

There are loads of WinAPI-s to create a thread, but as far as I know all of them ends in either NtCreateThread or NtCreateThreadEx. For eg if I put a breakpoint on these two and I suppose they aren't removed and the target is not using direct syscalls, can I assume that I can SAFELY catch EVERY single try of creating a new thread from that process? I know, debuggers have a feature of breaking on new threads, but this time I'd like to catch the moment before the creation.

I also know about that one can call any form of CreateRemoteThread externally, but is there any reasons why a clean OS would do so?

So, for example if I suspend all the threads of a process, is there anything that would "legally" start a thread in the process, which could theoretically find out that I'm messing with the process? For example if something would start an internal ntdll function, or a timed callback which starts a new thread (I don't know if it's possible, just brainstorming) - if it was hooked, a malware could actually redirect code execution to its own code which may detect things.

I don't care about any software like an anti-virus or apparently any external malware trying to run its own code, I'm curious if the OS would do so in any situation or by forcing it?

I know that various cases may happen, my target malware may write into external processes which may be able to resume the original process or create a new thread in it, or even more advanced things, but I'd like to gradually check for possibilities and also improve my knowledge on Nt internals :)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.