Windows Defender
Malwarebytes Anti-Malware
CrowdStrike Falcon EDR (Falcon Complete + OverWatch)

Manually implementing NTAPI operations through indirect system calls
Disabling Breaking telemetry features (i.e ETW)
Polymorphism through compile-time hash generation
Obfuscating API function names and pointers
Duplicating existing LSASS handles instead of opening new ones
Creating offline copies of the LSASS process to perform memory dumps on
Corrupting the MDMP signature of dropped files
Probably other stuff I forgot to mention here