One Day Sec

What is AtomBombing and how does it achieve code injection?

AtomBombing is a code injection technique disclosed by EnSilo in 2016 that works across all Windows versions. It exploits the Global Atom Table to pass shellcode between processes and uses APC injection via the undocumented `NtQueueApcThread` function to force the target process to retrieve and execute the payload. The technique is described in detail in the AtomBombing Exploitation Analysis article.
AtomBombingcode injectionAPC injectionNtQueueApcThreadGlobal Atom Table

Browse all Q&A →