Ekko A small sleep obfuscation technique that uses CreateTimerQueueTimer Win32 API. Proof of Concept. Can be done better Credit Austin Hudson (@SecIdiot) https://suspicious.actor/2022/05/05/mdsec-nighthawk-study.html