PROCESS PRELUDING: CHILD PROCESS INJECTION BEFORE THE STORY BEGINS

Summary from the TLDR InfoSec newsletter

Many security products in Windows 10 and 11 use kernel Event Tracing for Windows (ETW) hooks to monitor process creation and be notified of potentially malicious activity. An attacker can bypass these checks by exploiting a race condition between the kernel's completion of the executive process object setup and the invocation of process-creation callbacks. Attackers can also use legacy APIs for process creation, which do not trigger process-creation callbacks.