Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1678_delay-execution
Adversaries may employ various time-based methods to evade detection and analysis.
Passed 20 of 22 test cases with the skill, and 12 of 22 without it.
and 6 more in the full report
8 fixed12 passed either way2 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 8 test cases the skill fixed. Same model, same prompt, with and without the skill.
How many detection strategies are assessed in the framework overview for multi-platform detection of T1678 Delay Execution?
| Checked | Without skill | With skill |
|---|---|---|
| Specifies 1 detection strategy. | Missed | Passed |
The instructions your model reads when the skill loads.
Adversaries may employ various time-based methods to evade detection and analysis. These techniques often exploit system clocks, delays, or timing mechanisms to obscure malicious activity, blend in with benign activity, and avoid scrutiny. Adversaries can perform this behavior within virtualization/sandbox environments or natively on host systems.
Adversaries may utilize programmatic sleep commands or native system scheduling functionality, for example Scheduled Task/Job. Benign commands or other operations may also be used to delay malware execution or ensure prior commands have had time to execute properly. Loops or otherwise needless repetitions of commands, such as ping, may be used to delay malware execution and potentially exceed time thresholds of automated analysis environments. Another variation, commonly referred to as API hammering, involves making various calls to Native API functions in order to delay execution (while also potentially overloading analysis environments with junk data).
Platforms: Linux, macOS, Windows
Identify Attack Surface: Determine if the target environment is susceptible to Delay Execution by examining the target platforms (Linux, macOS, Windows).
Assess Existing Defenses: Review whether mitigations for T1678 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
No specific mitigations documented for this technique.
test cases passed, vs 12 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.