T1678 Delay Execution

High-Level Description

Adversaries may employ various time-based methods to evade detection and analysis. These techniques often exploit system clocks, delays, or timing mechanisms to obscure malicious activity, blend in with benign activity, and avoid scrutiny. Adversaries can perform this behavior within virtualization/sandbox environments or natively on host systems.

Adversaries may utilize programmatic sleep commands or native system scheduling functionality, for example Scheduled Task/Job. Benign commands or other operations may also be used to delay malware execution or ensure prior commands have had time to execute properly. Loops or otherwise needless repetitions of commands, such as ping, may be used to delay malware execution and potentially exceed time thresholds of automated analysis environments. Another variation, commonly referred to as API hammering, involves making various calls to Native API functions in order to delay execution (while also potentially overloading analysis environments with junk data).

Kill Chain Phase

• Defense Evasion (TA0005)

Platforms: Linux, macOS, Windows

What to Check

• ] Identify if Delay Execution technique is applicable to target environment
• ] Check Linux systems for indicators of Delay Execution
• ] Check macOS systems for indicators of Delay Execution
• ] Check Windows systems for indicators of Delay Execution
• ] Assess detection coverage (1 detection strategies)

How to Test

Manual Testing

1. Identify Attack Surface: Determine if the target environment is susceptible to Delay Execution by examining the target platforms (Linux, macOS, Windows).

1. Assess Existing Defenses: Review whether mitigations for T1678 are in place. If defenses are absent or misconfigured, this technique may be exploitable.

1. Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.

> Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.

Remediation Guide

No specific mitigations documented for this technique.

Detection

Multi-Platform Detection Strategy for T1678 - Delay Execution

Risk Assessment

| Finding | Severity | Impact | | ------------------------------------ | -------- | --------------- | | Delay Execution technique applicable | High | Defense Evasion |

CWE Categories

| CWE ID | Title | | ------- | ---------------------------- | | CWE-693 | Protection Mechanism Failure |

References

• Joe Sec Nymaim
• Joe Sec Trickbot
• Revil Independence Day
• Netskope Nitol
• Atomic Red Team - T1678
• MITRE ATT&CK - T1678