SparroWocky Call Stack Spoofing via Hooked CreateThread/AnimateWindow

Ibrahim Saud@tektrix

•updated Sep 17, 2026•0•0•3

Detects instances of process call stack spoofing, specifically techniques like SparroWocky (hooking CreateThread to report fake start addresses such as AnimateWindow) or SilentMoonwalk (forged call stacks masking API call origins as RtlUserThreadStart or BaseThreadInitThunk) used to evade EDR behavioral monitoring.