Process hollowing of dllhost.exe + 2.7 KB position-independent shellcode
+ direct NtLoadDriver syscall. Eight rounds of iteration against the
Cortex XDR sync.suspicious_driver_service_creation rule family, ending in
end-to-end success with the deployed Win11 24H2 ruleset silent.
The specific signed driver, the new primitives it exposes, and the IOCTL
walkthrough are tracked separately through coordinated disclosure.
Companion post: https://trexnegro.github.io/posts/bypassing-cortex-driver-load-coverage-process-hollow-shellcode/
TREXNEGRO