Published on Thu 06 November 2025 by SAERXCIT (@SAERXCIT)
TL;DR: Using call gadgets to insert arbitrary modules in the call stack during module load, breaking signatures used in detection rules. The code is available here: https://github.com/AlmondOffSec/LibTPLoadLib