T1497.003 Time Based Checks

T1497.003 Time Based Checks

Sub-technique of: T1497

High-Level Description

Adversaries may employ various time-based methods to detect virtualization and analysis environments, particularly those that attempt to manipulate time mechanisms to simulate longer elapses of time. This may include enumerating time-based properties, such as uptime or the system clock.

Adversaries may use calls like GetTickCount and GetSystemTimeAsFileTime to discover if they are operating within a virtual machine or sandbox, or may be able to identify a sandbox accelerating time by sampling and calculating the expected value for an environment's timestamp before and after execution of a sleep function.

Kill Chain Phase

• Defense Evasion (TA0005)
• Discovery (TA0007)

Platforms: Linux, macOS, Windows

What to Check

• Identify if Time Based Checks technique is applicable to target environment
• Check Linux systems for indicators of Time Based Checks
• Check macOS systems for indicators of Time Based Checks
• Check Windows systems for indicators of Time Based Checks
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Delay execution with ping

Uses the ping command to introduce a delay before executing a malicious payload.

Supported Platforms: linux, macos

ping -c #{ping_count} 8.8.8.8 > /dev/null
#{evil_command}