T1678 — Delay Execution

Tactic: Stealth · Platforms: Linux, macOS, Windows

Adversaries may employ various time-based methods to evade detection and analysis. These techniques often exploit system clocks, delays, or timing mechanisms to obscure malicious activity, blend in with benign activity, and avoid scrutiny. Adversaries can perform this behavior within…

Sigma detection rules (3)

T1678 Delay Execution

title: T1678 Delay Execution
id: a79a3daa-80f9-499a-95ec-d8194f32d2a0
description: 'Multi-Platform Detection Strategy for T1678 - Delay Execution. (Retargeted to Sysmon EventID matching process_creation telemetry for reliable field coverage.) Tune using: TimeWindow, ParentProcessName, SleepFunctionPattern.'
references:
  - https://attack.mitre.org/techniques/T1678
author: Shahrukh Khan
date: 2026-03-26
license: MIT
tags:
  - attack.stealth
  - attack.t1678

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection_sleep:
    CommandLine|contains: 'Start-Sleep'

  selection_large_delay:
    CommandLine|re: '-Seconds\s+([0-9]{4,}|[5-9][0-9]{2})'

  selection_loop_construct:
    CommandLine|re: '(?i)\b(for|while)\s*\('

  condition: selection_sleep and (selection_large_delay or selection_loop_construct)

falsepositives:
  - Legitimate scripts pausing execution for entirely benign reasons, especially ones using large -Seconds values for scheduled waits; sandbox/sleep-evasion detection is fundamentally a behavioral/timing signal that a single Sigma event cannot capture well - recommend EDR execution-timeline analysis instead.

level: informational

T1678 Delay Execution

title: T1678 Delay Execution
id: eaa779f5-d216-472e-8e28-beab0f795169
description: 'Multi-Platform Detection Strategy for T1678 - Delay Execution. The original rule matched base64 -d/$(printf/eval shell-obfuscation patterns, which detect command obfuscation, not the sleep/loop/timing-delay behavior this technique actually describes. Retargeted to actual delay primitives: sleep/usleep invoked with large durations and ping -c invoked with a high loop count. API hammering (rapid junk Native API calls to burn analysis time) is a Windows in-process concept with no Linux auditd equivalent and is intentionally not represented here. Tune using: DelayThresholdSeconds, PingCountThreshold, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1678
author: Shahrukh Khan
date: 2026-04-23
license: MIT
tags:
  - attack.stealth
  - attack.t1678

logsource:
  category: process_creation
  product: linux

detection:
  selection_sleep_bin:
    type: EXECVE
    a0|endswith:
      - '/sleep'
      - '/usleep'
    a1|re: '^[0-9]{3,}
    
  


  selection_ping_loop:
    type: EXECVE
    a0|endswith: '/ping'
    a1|contains: '-c'
    a2|re: '^[0-9]{3,}
    
  



  condition: 1 of selection_*

falsepositives:
  - Legitimate scripts commonly call sleep/usleep with multi-hundred-second waits for service-readiness polling or backoff retries; ping -c with a high count is also used for basic connectivity/latency testing. The TimeBetweenSyscalls statistical timing baseline this technique also relies on cannot be expressed from discrete auditd EXECVE events.

level: medium

T1678 Delay Execution

title: T1678 Delay Execution
id: fea1d3dc-92f3-4c31-8e52-187506d1c311
description: 'Multi-Platform Detection Strategy for T1678 - Delay Execution. (Retargeted to the image_load macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ScriptPattern, UserContext, DelayDurationThreshold.'
references:
  - https://attack.mitre.org/techniques/T1678
author: Shahrukh Khan
date: 2026-05-18
license: MIT
tags:
  - attack.stealth
  - attack.t1678

logsource:
  category: image_load
  product: macos

detection:
  selection:
    ImageLoaded|endswith: '.dylib'
    ImageLoaded|contains: '/tmp/'

  condition: selection

falsepositives:
  - Mutex-based execution gating typically happens through in-memory lock files or named semaphores with no reliable macOS telemetry artifact; this rule only weakly approximates it through an unrelated temp-path dylib load pattern and will have both significant false positives and false negatives.

level: low

Explore