Correlated use of sleep/delay mechanisms (e.g., kernel32!Sleep, NTDLL APIs) in short-lived processes, combined with parent processes invoking suspicious scripts (e.g., wscript, powershell) with minimal user interaction.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | WinEventLog:Sysmon | EventCode=1 |
| Module Load (DC0016) | WinEventLog:Sysmon | EventCode=7 |
| Field | Description |
|---|---|
| TimeWindow | Delay duration that distinguishes benign scripts from evasive behavior. |
| ParentProcessName | Legitimate parent-child combinations may differ across environments. |
| SleepFunctionPattern | Different APIs may be used to invoke sleep (e.g., Sleep, NtDelayExecution). |
Shell scripts or binaries invoking repeated 'sleep', 'ping', or low-level syscalls (e.g., nanosleep) in short-lived execution chains with no user or system interaction. Frequently seen in malicious cron jobs or payload stagers.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | auditd:SYSCALL | execve or nanosleep with no stdout/stderr I/O |
| Script Execution (DC0029) | auditd:PROCTITLE | scripting loop invoking sleep/ping |
| Field | Description |
|---|---|
| CommandLineRegex | Environment-specific delay scripts may vary (sleep 300, ping -n 60, etc.). |
| TimeBetweenSyscalls | Threshold for determining if delay is artificially extended. |
| UserContext | Root vs. service user context alters risk profile. |
Execution of AppleScript, bash, or launchd jobs that invoke delay functions (e.g., sleep, delay in AppleScript) with limited parent interaction and staged follow-on commands.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | macos:unifiedlog | launchd or osascript spawns process with delay command |
| Module Load (DC0016) | macos:unifiedlog | delay/sleep library usage in user context |
| Field | Description |
|---|---|
| ScriptPattern | AppleScript vs shell scripts differ per threat and org. |
| UserContext | Execution under user vs daemon context changes severity. |
| DelayDurationThreshold | Amount of delay that distinguishes benign usage vs evasion. |