Process creation involving suspicious delays (e.g., Sleep, ping -n loops, WaitForSingleObject), followed by sensitive system access or lateral movement behaviors.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | WinEventLog:Sysmon | EventCode=1 |
| Module Load (DC0016) | WinEventLog:Sysmon | EventCode=7 |
| Field | Description |
|---|---|
| SleepDurationThreshold | Defines maximum allowable sleep duration in milliseconds before triggering anomaly detection. |
| TimeBetweenExecutionAndNextStage | Temporal window between initial process and next stage (e.g., lateral movement or persistence), used to correlate dormant activity. |
| UserContext | Whether the activity occurs in SYSTEM or user context may affect legitimacy scoring. |
Script-based execution of sleep loops or time delay commands (e.g., sleep, ping delay, while-loops) followed by file creation or network connections.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | auditd:SYSCALL | execve of sleep or ping command within script interpreted by bash/python |
| File Metadata (DC0059) | auditd:SYSCALL | file write after sleep delay |
| Field | Description |
|---|---|
| SleepLoopCount | Defines how many loop iterations or sleep cycles are considered anomalous in the monitored environment. |
| ExecutionScriptType | Identifies which scripting interpreter is used (e.g., bash, python, perl) to adjust detection logic. |
Use of usleep, nanosleep, or NSTimer calls in executables or binaries with no GUI interaction, especially followed by disk/network activity.
| Data Component | Name | Channel |
|---|---|---|
| OS API Execution (DC0021) | macos:unifiedlog | application logs referencing NSTimer, sleep, or launchd delays |
| Process Creation (DC0032) | WinEventLog:Sysmon | EventCode=1 |
| Field | Description |
|---|---|
| AppBundleIdentifier | Correlate with known/expected signed apps vs. unsigned binaries to reduce noise. |
| TimeToNextEvent | Minimum time expected between process start and observable I/O for normal apps. |