Ekko Timer Queue Sleep Obfuscation - Rapid RX/RW Memory Protection Cycling
Detects memory protection modification patterns indicative of the Ekko sleep obfuscation technique. Ekko cyclically transitions memory regions containing beacon code between PAGE_EXECUTE_READ and PAGE_READWRITE states using timer queue callbacks to evade memory scanning tools. The detection identifies rapid, repeating, bidirectional memory protection changes on private memory regions within a 600ms window.
Microsoft Sentinel (KQL)
