BusyWork — how to make sleep() 😴 invisible to EDR

The article describes BusyWork — a Rust library that replaces sleep() calls with realistic, varied activity to evade EDR detection.

Using sleep() for pauses between actions creates two detection vectors: 🔎Static — the presence of timing primitives (Duration, Instant, Sleep, WaitForSingleObject) is easily detected by SAST tools and sandbox environments 🔎Behavioral — monitoring of thread state transitions and identifying periodic sleep/wake patterns with minimal activity between wake-ups allows EDR solutions to detect this behavior

🥷🏻BusyWork attempts to bypass both approaches: the compiled binary contains no timing primitives, and during a "pause" it can emulate over 2.5 million combinations of realistic operations — from API calls to I/O and memory activity.

🔗 Article: https://patchi.fyi/blog/busywork-sleep-replacement

📎 Tool: https://github.com/PatchRequest/BusyWork