Adam on Twitter: "@BlackMatter23 @binaryz0ne @ionstorm @zodiacon I guess it's PspInsertProcess -> SeAuditProcessCreation ... -> 4688 and... PspInsertProcess is called before PspInsertThread inside NtCreateUserProcess" / Twitter
https://twitter.com/Hexacorn/status/1420053502554951689