T1497.003, Time Based Checks, uses time itself to detect or outlast analysis. It applies to Linux, macOS and Windows and falls under stealth and discovery.
How attackers use it
Adversaries may use time based methods to detect virtualization and analysis environments, particularly those that manipulate time to simulate a longer wait. They can enumerate time properties such as uptime or the system clock. MITRE names calls such as GetTickCount and GetSystemTimeAsFileTime. A sandbox that speeds up time may also be identified by sampling the expected timestamp before and after a sleep call.
MITRE's examples include a payload that waits a set time before downloading its second stage, malware that compares timing to detect a virtual environment, and a loader that delays for 30 minutes after execution to evade sandbox monitoring.
How to detect it
MITRE describes three analytics.
- Windows: process creation with suspicious delays, such as Sleep, repeated ping commands or WaitForSingleObject, followed by access to sensitive systems or lateral movement.
- Linux: scripts running sleep loops or delay commands, followed by file creation or network connections.
- macOS: binaries with no GUI interaction that call usleep, nanosleep or NSTimer, followed by disk or network activity.
MITRE names no log sources. Process creation, script execution, and file and network activity telemetry are the data to collect. The key point is that the activity after the delay matters more than the delay.
How to reduce the risk
MITRE says prevention is hard. Run analysis long enough to outlast typical delays, and make sure your sandbox handles sleep calls correctly while keeping its clock consistent. Pair that with endpoint detection that sees what happens after the wait.
Quick check
How can a sandbox that accelerates time be detected?
By comparing timestamps before and after a sleep call against the expected elapsed time.
