Pay2Key Sandbox Evasion - timeout.exe /t 10 Execution Delay
This rule detects the execution of the Windows 'timeout.exe' utility with a specific 10-second delay parameter, initiated by common command-line interpreters (cmd.exe, powershell.exe, setup.cmd) or from directories containing '7ZipSfx'. This pattern is frequently used by installers and self-extracting archives to pause execution during malicious software deployment or to delay the cleanup of artifacts.
Cortex XDR
