PoC of obtaining the _EPROCESS address of any cmd/pwsh in user mode. - View it on GitHub