[PhantomBlade]

Can someone explain how Runtime Detection works please?

[pro_fesnoob]

There are different methods

For example, runtime-detection means its monitoring the code-flow, what is happening during the runtime.
(Or scans the sections and compare them (process doppelgänging bypasses this)
Some Av's are looking for apicalls.
While u inject code u probably use WinApi's and this triggers the AV.

If u understand how a injection works u can see where the weakpoints are, creativity is important... or u reverse engineer the AV

[Morphine]

Runtime detection is when your payload got detected on runtime (memory) so the antivirus is scanning the program on memory and it got detected