Cross-source coverage

T1497.003 / ATT&CK

Virtualization/Sandbox Evasion: Time Based Checks

5 rules across 3 sources.

From MITRE ATT&CK 19.2

Adversaries may employ various time-based methods to detect virtualization and analysis environments, particularly those that attempt to manipulate time mechanisms to simulate longer elapses of time. This may include enumerating time-based properties, such as uptime or the system clock.

Adversaries may use calls like GetTickCount and GetSystemTimeAsFileTime to discover if they are operating within a virtual machine or sandbox, or may be able to identify a sandbox accelerating time by sampling and calculating the expected value for an environment's timestamp before and after execution of a sleep function.

Tactics
Stealth · Discovery
Platforms
Linux · macOS · Windows
Telemetry
WinEventLog:Sysmonauditd:SYSCALLmacos:unifiedlog

How MITRE says to detect it DET0141

Detect Time-Based Evasion via Sleep, Timer Loops, and Delayed Execution

Windows Analytic 0396

Process creation involving suspicious delays (e.g., Sleep, ping -n loops, WaitForSingleObject), followed by sensitive system access or lateral movement behaviors.

  • WinEventLog:Sysmon EventCode=1
  • WinEventLog:Sysmon EventCode=7

Linux Analytic 0397

Script-based execution of sleep loops or time delay commands (e.g., sleep, ping delay, while-loops) followed by file creation or network connections.

  • auditd:SYSCALL execve of sleep or ping command within script interpreted by bash/python
  • auditd:SYSCALL file write after sleep delay

macOS Analytic 0398

Use of `usleep`, `nanosleep`, or `NSTimer` calls in executables or binaries with no GUI interaction, especially followed by disk/network activity.

  • macos:unifiedlog application logs referencing NSTimer, sleep, or launchd delays
  • WinEventLog:Sysmon EventCode=1

View on attack.mitre.org ↗

splunk/security_content

3 rules
Detection Severity Format
Ping Sleep Batch Command Undefined SPL
Windows Time Based Evasion Undefined SPL
Windows Time Based Evasion via Choice Exec Undefined SPL

elastic/detection-rules

1 rule
Detection Severity Format
Delayed Execution via Ping Low Elastic TOML

socfortress/Wazuh-Rules

1 rule
Detection Severity Format
Ping command used with -c option — potential sandbox evasion (T1497.003) command= ping -c 3 8.8.8.8 High Wazuh XML

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.