FOLIAGE/AceLdr APC-Based Sleep Obfuscation via Sequential NtQueueApcThread Calls
Detects APC-based sleep encryption patterns commonly used by malware loaders like FOLIAGE and AceLdr. The rule identifies suspicious sequences of NtQueueApcThread and NtTestAlert calls targeting the same thread, which are used to automate the in-memory encryption/decryption cycle between C2 callbacks while evading detection by maintaining a quiet user-mode memory profile.
Microsoft Sentinel (KQL)
