ETW patching
Overwriting the function in your own process that ships trace events to Windows, so the process stops reporting on itself. Two bytes are enough.
Event Tracing for Windows is the channel a large share of all security telemetry travels through, including everything the .NET runtime reports about which assemblies load and which methods get compiled — which is precisely what exposes code running straight out of memory. The calls go through a function in ntdll that lives in the process's own address space and is writable by whoever already runs there. Replacing its first instruction with a return makes the events disappear without producing any error. The limitation matters: it only affects that one process and only events generated in user mode. Kernel providers, above all the variant Microsoft reserves for security products, are untouched. Detection works either by comparing the module's code against the file on disk or by noticing that a process which ought to be talking has suddenly gone quiet.