Modern Twists: Early Bird and Module Stomping

• Early Bird APC: inject into a suspended child process and queue an APC so the payload runs during process init, before EDR hooks are installed.
• Module stomping (DLL hollowing): load a legitimate, signed DLL into the target, then overwrite its code section with the payload.
• Payload executes from memory that is backed by a signed, on-disk module — looks far less suspicious than fresh PAGE_EXECUTE_READWRITE allocations.
• Trend: techniques increasingly aim to avoid the noisy classic API sequence and to blend payloads into trusted memory.