T1497.003 — Time Based Checks

Tactics: Stealth, Discovery · Platforms: Linux, macOS, Windows

Adversaries may employ various time-based methods to detect virtualization and analysis environments, particularly those that attempt to manipulate time mechanisms to simulate longer elapses of time. This may include enumerating time-based properties, such as uptime or the system clock.…

Sub-technique of Virtualization/Sandbox Evasion (T1497).

Sigma detection rules (3)

T1497.003 Virtualization/Sandbox Evasion: Time Based Checks

title: "T1497.003 Virtualization/Sandbox Evasion: Time Based Checks"
id: 7cc18188-6255-4b87-ab90-80a4559cc5fb
description: 'Detect Time-Based Evasion via PowerShell sleep/elapsed-time comparison patterns (Start-Sleep combined with Measure-Command or manual Get-Date/TotalSeconds delta checks) commonly used to detect accelerated sandbox clocks. Note: the underlying API-level checks (GetTickCount, GetSystemTimeAsFileTime) are not directly visible in standard Windows Security/Sysmon logs; this rule is a scripting-layer proxy, not a full detection of native API-based timing checks. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: SleepDurationThreshold, TimeBetweenExecutionAndNextStage, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1497/003
author: Shahrukh Khan
date: 2026-06-16
license: MIT
tags:
  - attack.stealth
  - attack.discovery
  - attack.t1497.003

logsource:
  category: process_creation
  product: windows

detection:
  selection_sleep_measure:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains|all:
      - 'Start-Sleep'
      - 'Measure-Command'
  selection_sleep_totalseconds:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains|all:
      - 'Start-Sleep'
      - 'TotalSeconds'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: 1 of selection_* and not filter_system_account

falsepositives:
  - Legitimate performance-testing or benchmarking scripts using Measure-Command/Start-Sleep; System and service accounts (SYSTEM, LOCAL SERVICE, NETWORK SERVICE) performing the same action are excluded via filter_system_account; tune further with script-path allowlists if noise remains.

level: medium

T1497.003 Virtualization/Sandbox Evasion: Time Based Checks

title: "T1497.003 Virtualization/Sandbox Evasion: Time Based Checks"
id: d4b011a9-7f19-4a33-888f-083e817222b7
description: 'Detect Time-Based Evasion via long-duration Sleep invocations; a single sleep call cannot distinguish a sandbox time-check loop from a benign delay, so this base rule stays informational-only and is paired with a companion event_count correlation rule that raises severity when the same audit session repeats long sleeps several times in a short window, approximating the sleep-then-compare-timestamp loop the technique describes. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: SleepLoopCount, ExecutionScriptType.'
references:
  - https://attack.mitre.org/techniques/T1497/003
author: Shahrukh Khan
date: 2026-04-09
license: MIT
tags:
  - attack.stealth
  - attack.discovery
  - attack.t1497.003

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '/sleep'
    a1|re: '^[0-9]{3,}
    
  



  condition: selection

falsepositives:
  - Legitimate scripts commonly sleep for tens or hundreds of seconds between retries/polling; a single long sleep is expected and this base rule alone should not be actioned - see the companion correlation rule below (SleepLoopCount) for the repeated-sleep signal that is actually indicative of a sandbox time-check loop.

level: informational
---
title: "T1497.003 Virtualization/Sandbox Evasion: Time Based Checks - Repeated Sleep Loop"
id: 9b4e7a2c-3d5f-4a1b-8c6e-1f9a3b7d2e4c
description: 'Correlation companion for d4b011a9-7f19-4a33-888f-083e817222b7: counts long-duration sleep invocations (a1 >= 3 digits, i.e. >=100s) within the same audit session (ses) within a 2-minute window, approximating a sandbox time-check loop (repeated sleep-then-compare-clock behavior) rather than a single benign delay.'
status: experimental
correlation:
  type: event_count
  rules:
    - d4b011a9-7f19-4a33-888f-083e817222b7
  group-by:
    - ses
  timespan: 2m
  condition:
    gte: 3
level: medium

T1497.003 Virtualization/Sandbox Evasion: Time Based Checks

title: "T1497.003 Virtualization/Sandbox Evasion: Time Based Checks"
id: ba622e2f-ea31-4d79-b919-2a017404dd59
description: 'Detects command lines invoking time/tick-count APIs (GetTickCount, GetSystemTimeAsFileTime, timeGetTime) or querying system uptime via LastBootUpTime, used to detect sandbox time manipulation (the previous version required Get-Process together with vmtoolsd/vboxservice references, which is VM-tooling/process-list discovery, T1497.001, not a time-based check). Tune using: AppBundleIdentifier, TimeToNextEvent.'
references:
  - https://attack.mitre.org/techniques/T1497/003
author: Shahrukh Khan
date: 2026-05-31
license: MIT
tags:
  - attack.stealth
  - attack.discovery
  - attack.t1497.003

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection_api:
    CommandLine|contains:
      - 'GetTickCount'
      - 'GetSystemTimeAsFileTime'
      - 'timeGetTime'
  selection_uptime:
    CommandLine|contains|all:
      - 'LastBootUpTime'

  condition: 1 of selection_*

falsepositives:
  - Legitimate performance-monitoring, profiling, or diagnostic scripts calling these same timing APIs.

level: informational

Related sub-techniques

Explore