Adversaries may employ various time-based methods to evade detection and analysis. These techniques often exploit system clocks, delays, or timing mechanisms to obscure malicious activity, blend in with benign activity, and avoid scrutiny. Adversaries can perform this behavior within virtualization/sandbox environments or natively on host systems.
Adversaries may utilize programmatic sleep commands or native system scheduling functionality, for example Scheduled Task/Job. Benign commands or other operations may also be used to delay malware execution or ensure prior commands have had time to execute properly. Loops or otherwise needless repetitions of commands, such as ping, may be used to delay malware execution and potentially exceed time thresholds of automated analysis environments.[1][2] Another variation, commonly referred to as API hammering, involves making various calls to Native API functions in order to delay execution (while also potentially overloading analysis environments with junk data).[3][4]
| ID | Name | Description |
|---|---|---|
| C0057 | 3CX Supply Chain Attack |
During the 3CX Supply Chain Attack, AppleJeus's software generates a randomly selected date that is between 1-4 weeks in the future. This timestamp is then checked against the current time of the compromised machine, and the malware will sleep until that time is encountered.[5] |
| S9031 | AshTag | |
| S9015 | BRICKSTORM |
BRICKSTORM has embedded delayed-start logic that attempts to circumvent detection for long-term persistence.[7][8] BRICKSTORM has been observed configured with a "delay" timer built-in that waited for a hard-coded date months in the future before beginning to beacon to the configured C2 domain.[9] |
| S9038 | DynoWiper |
DynoWiper has utilized a five-second delay using |
| S9033 | Fooder |
Fooder has used a custom delay function ( |
| S9010 | GlassWorm |
GlassWorm has used a timeout function set to |
| S1230 | HIUPAN |
HIUPAN has used a config file "$.ini" to store a sleep multiplier to execute at a set interval value prior to initiating a watcher function that checks for a specific running process, that checks for removable drives and installs itself and supporting files if one is available.[14][15] |
| G0094 | Kimsuky |
Kimsuky has utilized the Sleep function to ensure execution of scripts.[16][17] |
| S9032 | MuddyViper |
MuddyViper has the ability to sleep for a certain amount of time, with the default being one minute.[12] |
| G0129 | Mustang Panda |
Mustang Panda has delayed the execution of payloads leveraging ping echo requests |
| S9014 | PHASEJAM |
PHASEJAM has used the |
| S9019 | PureCrypter |
PureCrypter has the ability to delay for a specified number of seconds before execution.[21] |
| S1242 | Qilin | |
| S9037 | RustyWater |
RustyWater has generated random sleep intervals between C2 communication.[23] |
| S9008 | Shai-Hulud |
Shai-Hulud has delayed execution of its larger payloads by forking itself into background process.[24] |
| S9024 | SPAWNCHIMERA |
SPAWNCHIMERA has used delayed execution to pause for a defined interval before performing environment discovery, repeatedly checking for specific processes, such as the |
| S9001 | SystemBC |
SystemBC has leveraged the Sleep functions before and after commands to ensure execution using the hexadecimal values within commands to include |
| S1239 | TONESHELL |
TONESHELL has the ability to pause operations for a specified duration prior to follow-on execution of activities.[27] |
| S0275 | UPPERCUT |
UPPERCUT can use a sleep function to delay execution.[28][29] |
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0372 | Multi-Platform Detection Strategy for T1678 - Delay Execution | AN1048 |
Correlated use of sleep/delay mechanisms (e.g., kernel32!Sleep, NTDLL APIs) in short-lived processes, combined with parent processes invoking suspicious scripts (e.g., wscript, powershell) with minimal user interaction. |
| AN1049 |
Shell scripts or binaries invoking repeated 'sleep', 'ping', or low-level syscalls (e.g., nanosleep) in short-lived execution chains with no user or system interaction. Frequently seen in malicious cron jobs or payload stagers. |
||
| AN1050 |
Execution of AppleScript, bash, or launchd jobs that invoke delay functions (e.g., sleep, delay in AppleScript) with limited parent interaction and staged follow-on commands. |