The research explores a Windows EDR evasion technique that forges a legitimate-looking call stack. The author demonstrates how to combine the Thread Pool, Windows API callback functions, and indirect system calls to create a 

Researchers demonstrate a Windows EDR evasion technique using thread pools and callback trampolining to spoof call stacks. This method bypasses Intel CET protections, allowing malicious code to blend with normal system activity undetected.

Call Stack Spoofing via Thread Pool and Enum Callback Trampolining