Threat reportThreat IntelligenceTL-2026-4458
Shellcode execution via Windows thread-pool wait callbacks (CreateThreadpoolWait) - public technique write-up
Shellcode execution via Windows thread-pool wait callbacks (TL-2026-4458), also tracked as Malware development trick 67, is a low-severity tracked intrusion set, first published 2026-10-26. It has no confirmed attribution, affects Microsoft Windows (x64) thread-pool API, maps to 4 MITRE ATT&CK techniques (T1055, T1106, T1587.001), and is covered by 9 detection rules and 10 indicators of compromise.
- Severity
- LOWAssessed severity
- CVEs
- 0None referenced
- Techniques
- 4MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 10Indicators of compromise
Key facts for TL-2026-4458
- Threat ID
- TL-2026-4458
- Also known as
- Malware development trick 67, CreateThreadpoolWait shellcode execution
- Severity
- LOW
- Status
- MONITORING
- Category
- THREAT_INTEL
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Detection rules
- 9
- Indicators of compromise
- 10
Malware and tooling in Shellcode execution via Windows thread-pool wait callbacks
Malware and tooling: Assembly, nasm -f bin meow.asm -o meow.bin, x86_64-w64-mingw32-gcc
How Shellcode execution via Windows thread-pool wait callbacks works
A public blog post by cocomelonc (2026-10-07), archived in the Malpedia library, demonstrates running shellcode by registering it as the callback of a Windows thread-pool wait object (CreateThreadpoolWait/SetThreadpoolWait) and triggering it with SetEvent. The article names no malware family, actor, CVE or in-the-wild use; it is an educational PoC.
The write-up 'Malware development trick 67' shows how shellcode can be dispatched through the Windows thread-pool wait API instead of CreateThread or similar direct execution primitives. The flow is: create trigger and completion events with CreateEventW; register a callback address and context pointer with CreateThreadpoolWait; associate the wait object with the trigger event via SetThreadpoolWait; then call SetEvent so a thread-pool worker thread invokes the callback. SetEventWhenCallbackReturns, WaitForThreadpoolWaitCallbacks and CloseThreadpoolWait are used for completion and cleanup.
Two examples are published. Example 1 (hack.c) allocates memory with VirtualAlloc, copies in a 73-byte returning x64 wait-callback payload assembled from meow.asm with NASM, changes protection to PAGE_EXECUTE_READ, flushes the instruction cache and registers the buffer address as the thread-pool callback. The payload shows a MessageBox ('Meow-meow!', caption '=^..^=') and must return to the thread pool rather than terminate the process; it receives API addresses and the completion event handle through the context pointer (RDX). Example 2 (hack2.c) implements the callback as a normal compiled C function (meow_callback) to show the same dispatch mechanism without handwritten assembly. Binaries were built with x86_64-w64-mingw32-gcc and tested on a Windows x64 lab; the author reports an ANY.RUN sandbox run with no threats detected.
No in-the-wild exploitation, CVE, actor, malware family or network infrastructure is reported. The author notes that thread-pool callbacks are ordinary Windows functionality used by many legitimate programs, so analysis should focus on the callback address (for example a dynamically allocated executable region rather than a module code section), the context data, and the triggering event. Because no network IOCs exist, no BeaconBeagle correlation was applicable.
MITRE ATT&CK techniques used in TL-2026-4458
Defense Evasion
T1055 Process Injection; T1620 Reflective Code Loading
Privilege Escalation
Execution
Resource Development
Affected products and versions in Shellcode execution via Windows thread-pool wait callbacks
- Microsoft — Windows (x64) thread-pool API
Vulnerable versions: Technique abuses standard Windows functionality; no specific vulnerable version identified
Remediation for Shellcode execution via Windows thread-pool wait callbacks
Immediate actions
- No patch applies; this is documented use of legitimate Windows thread-pool functionality
- Add the published example file names and API sequence to hunting watchlists for lab and sandbox triage
Workarounds
- Enable memory-protection mitigations (for example arbitrary code guard and dynamic code restrictions) for high-value processes where compatible
Longer-term hardening
- Deploy EDR with telemetry on VirtualAlloc/VirtualProtect followed by thread-pool callback registration
- Inspect thread-pool wait callback addresses for pointers into private executable memory rather than image-backed code
- Review the callback context data and the signaling event when triaging suspicious thread-pool activity
Timeline of Shellcode execution via Windows thread-pool wait callbacks
- cocomelonc publishes 'Malware development trick 66: TLS callbacks before main', an earlier callback-based execution write-up in the same series
- cocomelonc publishes 'MacOS malware persistence 13', listed by Malpedia as a related article
- cocomelonc publishes 'Malware analysis: part 12', listed by Malpedia as a related article
- Article added to the Malpedia library with no linked malware families or actors
- Example code (hack.c, hack2.c, hack3.c, meow.asm, meow.bin and compiled executables) published in the cocomelonc/meow GitHub repository
- cocomelonc publishes 'Malware development trick 67: Run shellcode via CreateThreadpoolWait' with C and assembly examples
Sources cited for Shellcode execution via Windows thread-pool wait callbacks
- Malware development trick 67: Run shellcode via CreateThreadpoolWait. C and assembly examples
- Malpedia library entry for the cocomelonc article
- cocomelonc/meow - 2026-10-07-malware-tricks-67 example code
- Microsoft Learn: CreateThreadpoolWait function (threadpoolapiset.h)
- MITRE ATT&CK T1055 Process Injection
- MITRE ATT&CK T1106 Native API
Detection coverage for TL-2026-4458
As of 2026-10-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4458 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.