Exploits don't have to pivot to PE files, and even the exploits that go that route don't have to do it in a way that triggers standard loader hooks (e.g. PsSetL

Exploits don't have to pivot to PE files, and even the exploits that go that route don't have to do it in a way that triggers standard loader hooks (e.g. PsSetLoadImageNotifyRoutine).