Sleep Masking

Goal: keep dormant code/data minimally observable during idle windows while preserving execution stability across repeated cycles.

When to activate

• You need encrypt-at-sleep behavior for an in-memory agent or loader.
• You are choosing among timer-queue/APC/waitable-timer/hook-based sleep orchestration.
• Your current sleep cycle is unstable (races, crashes, deadlocks) or noisy (easy telemetry signatures).
• You need mitigation-aware design for modern Windows hardening (CET/CFG) and stronger timer/APC hunting.

Core flow model

Treat sleep masking as a state machine: