SparroWocky-style call-stack spoofing hiding Sleep/NtDelayExecution calls

Ankit Mehta@Secvyn

•updated Sep 17, 2026•0•0•2

Detects anomalous thread execution call stacks indicative of the SparroWocky anti-forensic evasion technique. This method involves spoofing thread start addresses and call stacks by injecting or manually manipulating stack frames to include legitimate-looking system functions (e.g., BaseFlushAppcompatCacheWorker, BaseCheckVDMp) alongside malicious execution patterns involving NtDelayExecution and SleepEx to hide the true origin of code execution.