T1497.003 Time Based Checks

Technique: T1497.003
Tactics: Defense Evasion, Discovery
Research, 90 days: 2
KEV CVEs mapped: 0
SigmaHQ rules: 0
Elastic, Splunk: 4
thrunt rules: 0
Upstream: https://attack.mitre.org/techniques/T1497/003

MITRE description

Adversaries may employ various time-based methods to detect virtualization and analysis environments, particularly those that attempt to manipulate time mechanisms to simulate longer elapses of time. This may include enumerating time-based properties, such as uptime or the system clock. Adversaries may use calls like `GetTickCount` and `GetSystemTimeAsFileTime` to discover if they are operating within a virtual machine or sandbox, or may be able to identify a sandbox accelerating time by sampling and calculating the expected value for an environment's timestamp before and after execution of a sleep function.(Citation: ISACA Malware Tricks)

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

2026-10-14 Group-IB: KGB RAT: A Fully Undetectable Windows Trojan Built to Spy, Steal, and Terrorize
2026-08-13 Recorded Future Insikt: Malware Crypting Services and the Threat Actors Who Sell Them

Detection coverage

Elastic and Splunk rules

Delayed Execution via Ping (elastic)
Ping Sleep Batch Command (splunk)
Windows Time Based Evasion (splunk)
Windows Time Based Evasion via Choice Exec (splunk)

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.