Techniques › T1497.003 › AN0397
AN0397 Analytic 0397
Linux · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Script-based execution of sleep loops or time delay commands (e.g., sleep, ping delay, while-loops) followed by file creation or network connections.</p>
- Detects
- T1497.003 Time Based Checks
- Part of
- DET0141 Detect Time-Based Evasion via Sleep, Timer Loops, and Delayed Execution
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| auditd:SYSCALL | execve of sleep or ping command within script interpreted by bash/python | DC0032 Process Creation |
| auditd:SYSCALL | file write after sleep delay | DC0059 File Metadata |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
SleepLoopCount | Defines how many loop iterations or sleep cycles are considered anomalous in the monitored environment. |
ExecutionScriptType | Identifies which scripting interpreter is used (e.g., bash, python, perl) to adjust detection logic. |