Detecting Injection: Modules, Hooks, ETW

• Unusual modules: a DLL loaded from a temp/user path, or a process holding a module with no corresponding file on disk (reflective / hollowed).
• EDR userland hooks: EDRs patch ntdll functions to route calls through their sensor — and malware in turn tries to unhook them (a detectable act itself).
• ETW (Event Tracing for Windows): kernel/telemetry events for thread creation, image loads, and more; malware may try to patch or disable ETW to go dark.
• Kernel callbacks: PsSetCreateThreadNotifyRoutine, image-load callbacks give the OS a hard-to-evade vantage point.