I'd like to know about every possible way how a thread can be created in a process at the lowest possible level.
There are loads of WinAPI-s to create a thread, but as far as I know all of them ends in either
NtCreateThreadEx. For eg if I put a breakpoint on these two and I suppose they aren't removed and the target is not using direct syscalls, can I assume that I can SAFELY catch EVERY single try of creating a new thread from that process? I know, debuggers have a feature of breaking on new threads, but this time I'd like to catch the moment before the creation.
I also know about that one can call any form of CreateRemoteThread externally, but is there any reasons why a clean OS would do so?
So, for example if I suspend all the threads of a process, is there anything that would "legally" start a thread in the process, which could theoretically find out that I'm messing with the process? For example if something would start an internal ntdll function, or a timed callback which starts a new thread (I don't know if it's possible, just brainstorming) - if it was hooked, a malware could actually redirect code execution to its own code which may detect things.
I don't care about any software like an anti-virus or apparently any external malware trying to run its own code, I'm curious if the OS would do so in any situation or by forcing it?
I know that various cases may happen, my target malware may write into external processes which may be able to resume the original process or create a new thread in it, or even more advanced things, but I'd like to gradually check for possibilities and also improve my knowledge on Nt internals :)