With the advent of detections for PowerShell and script-based attacks, threat actors have shifted to .NET as a preferred method to perform post-exploitation tradecraft. As .NET framework is available by default on all Windows-based environments, the success rate of executing .NET assemblies is very high. .NET allows to interact with the Win32 APIs which are abused by attackers in various ways such as load assemblies directly into memory and inject into processes using a ton of process injection techniques. However, EDR vendors have upped their game to look or hook into how the unmanaged code is invoked from managed code. An attacker may get caught upon execution of suspicious Win32 APIs. Hence in this talk, we will explore tradecraft that would help evade detections that depend on such mechanisms.