Gargoyle-Style ROP/NtContinue Sleep Obfuscation Thread Context Manipulation

Ethan Andrews@eandrews

•updated Jul 6, 2026•0•0•0

Detects anomalous thread context manipulation events, specifically those involving multiple SetThreadContext API calls within a short period, consistent with Gargoyle-style ROP/NtContinue sleep obfuscation techniques. This method cycles memory protections during C2 beacon sleep intervals to evade point-in-time memory scanners by keeping executable memory hidden.