A process parameter-poisoning technique evades EDR by injecting code into process initialization structures without using the Windows APIs that EDR tools typically watch out for.
EDR Evasion Stack Helps Process Injection Slip Past Defenses
Summary + source link. No paywalls, no tracking.