Pay2Key Sandbox Evasion via timeout.exe /t 10 Delay

Ibrahim Saud@tektrix

•updated Jun 28, 2026•1•0•2

Detects execution of the Windows timeout.exe utility from cmd.exe or setup.cmd where the timeout.exe binary is not digitally signed by Microsoft Corporation. This behavior is indicative of potential living-off-the-land (LotL) activity where an attacker attempts to obfuscate or delay execution by utilizing built-in utilities with unsigned versions or repurposed names.