Because AV evasion should be easy.

Experiment with PAGE_GUARD protection to hide memory from other processes

Dynamically resolve and invoke Windows APIs using Rust. This might help to avoid suspicious imports and the usage of GetProcAddress.

Minimal PoC developed as discuss in https://captmeelo.com/redteam/maldev/2022/05/10/ntcreateuserprocess.html

It's a go variant of Hells gate! (directly calling windows kernel functions, but from Go!)

Leverage a legitimate WFP callout driver to prevent EDR agents from sending telemetry