Threat Actors may inject malicious code into process via process doppelgänging in order to evade process-based defenses as well as possibly elevate privileges. Process doppelgänging is a method of executing arbitrary code in the address space of a separate live process.
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.