Techniques › T1497 › T1497.003
T1497.003 Time Based Checks
stealth · discovery — Linux, macOS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
3
analytics
0
Sigma rules tagged attack.t1497.003
0
KEV CVEs mapped here
<p>Adversaries may employ various time-based methods to detect virtualization and analysis environments, particularly those that attempt to manipulate time mechanisms to simulate longer elapses of time. This may include enumerating time-based properties, such as uptime or the system clock.</p><p>Adversaries may use calls like
GetTickCount and GetSystemTimeAsFileTime to discover if they are operating within a virtual machine or sandbox, or may be able to identify a sandbox accelerating time by sampling and calculating the expected value for an environment's timestamp before and after execution of a sleep function.</p>KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0141 Detect Time-Based Evasion via Sleep, Timer Loops, and Delayed Execution v1.0
AN0396 WindowsProcess creation involving suspicious delays (e.g., Sleep, ping -n loops, WaitForSingleObject), followed by sensitive system access or lateral movement behaviors.Tunable:
SleepDurationThresholdTimeBetweenExecutionAndNextStageUserContextAN0397 LinuxScript-based execution of sleep loops or time delay commands (e.g., sleep, ping delay, while-loops) followed by file creation or network connections.auditd:SYSCALLexecve of sleep or ping command within script interpreted by bash/python→ DC0032 Process CreationTunable:SleepLoopCountExecutionScriptTypeAN0398 macOSUse ofusleep,nanosleep, orNSTimercalls in executables or binaries with no GUI interaction, especially followed by disk/network activity.macos:unifiedlogapplication logs referencing NSTimer, sleep, or launchd delays→ DC0021 OS API ExecutionTunable:AppBundleIdentifierTimeToNextEvent
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1497.003
No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content.