I was aware of commercial antivirus vendors (Crowdstrike) doing something like this, but this is the first I've seen it published by somebody in the open!

Have you considered writing up a blog post and submitting this to HN?

Thanks!

From the sound of it, the same mitigations for Copy Fail 1 are also effective here.