CODE EXECUTION INSIDE PID 0

Summary from the TLDR InfoSec newsletter

In Windows systems, PID 0 is a special process called the System Idle Process, which contains threads that execute when no other thread is ready to run on a given processor. The author of this post found that they could swap the pointer inside any _KPRCB to run code in PID 0 via the nt!PpmIdleSelectStates function. Hooking into PID 0 is advantageous as traditional detection APIs and lookups will fail and the execution does not require any system calls.