APC Injection (QueueUserAPC)

• An APC (Asynchronous Procedure Call) is a function queued to run on a specific thread when it enters an alertable state.
• Technique:
• Allocate + write shellcode (or a LoadLibrary call) in the target.
• QueueUserAPC(pCode, hThread, arg) on a target thread.
• When that thread next waits alertably, the APC fires and runs your code.
• Avoids CreateRemoteThread, which many tools watch closely.
• Variant Early Bird: queue the APC on a thread of a freshly created, still-suspended process so it runs before defenses arm.