PIVOTPIPE Sleep-Mask Artifacts Written to Disk (sleepmask.o / nb_sleep_dbg)

Ibrahim Saud@tektrix

•updated 18 days ago•0•0•3

Detects the presence of PIVOTPIPE loader artifacts, specifically the COFF sleep-mask object file (sleepmask.o) and its associated debug log (nb_sleep_dbg.txt), which are written to a randomly named subfolder within the Windows temporary directory as part of a sleep-obfuscation evasion sequence.