#1
Read this

What you need to know about Process Ghosting, a new executable image tampering attack | Elastic Blog

asking if someone already wrote or thinking to do something able to implement this one.

Seems interesting for evade AV