cyberstrikeus T1678 Delay Execution
High-Level Description
Adversaries may employ various time-based methods to evade detection and analysis. These techniques often exploit system clocks, delays, or timing mechanisms to obscure malicious activity, blend in with benign activity, and avoid scrutiny. Adversaries can perform this behavior within virtualization/sandbox environments or natively on host systems.
Adversaries may utilize programmatic sleep commands or native system scheduling functionality, for example Scheduled Task/Job. Benign commands or other operations may also be used to delay malware execution or ensure prior commands have had time to execute properly. Loops or otherwise needless repetitions of commands, such as ping, may be used to delay malware execution and potentially exceed time thresholds of automated analysis environments. Another variation, commonly referred to as API hammering, involves making various calls to Native API functions in order to delay execution (while also potentially overloading analysis environments with junk data).
Kill Chain Phase
- Defense Evasion (TA0005)
Platforms: Linux, macOS, Windows
What to Check
- Identify if Delay Execution technique is applicable to target environment
- Check Linux systems for indicators of Delay Execution
- Check macOS systems for indicators of Delay Execution
- Check Windows systems for indicators of Delay Execution
- Assess detection coverage (1 detection strategies)
How to Test
Manual Testing
Identify Attack Surface: Determine if the target environment is susceptible to Delay Execution by examining the target platforms (Linux, macOS, Windows).
Assess Existing Defenses: Review whether mitigations for T1678 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
Remediation Guide
No specific mitigations documented for this technique.
Detection
Multi-Platform Detection Strategy for T1678 - Delay Execution
Risk Assessment
| Finding | Severity | Impact |
|---|---|---|
| Delay Execution technique applicable | High | Defense Evasion |
CWE Categories
| CWE ID | Title |
|---|---|
| CWE-693 | Protection Mechanism Failure |