Thread Execution Hijacking

Adversaries may execute malicious code by hijacking a thread in a separate live process. Running code in another process can mask execution from process-based defenses and may provide access to that process's resources or privileges. This technique is distinct from changing Windows process-mitigation policy or disabling an EDR product.