Avoiding Get-InjectedThread for Internal Thread Creation

This short technical note describes an evasion technique where attackers use the Microsoft C runtime function _beginthreadex to start threads whose entry point resolves to msvcrt.dll (_threadstartex), thereby avoiding detection by the Get-InjectedThread heuristic that flags threads with entry points not backed by disk files. The author includes a proof-of-concept repository and clarifies the approach works for in-process memory-loaded code but not for cross-process injections.