Adversaries may employ various time-based methods to evade detection and analysis. These techniques often exploit system clocks, delays, or timing mechanisms to obscure malicious activity, blend in with benign activity, and avoid scrutiny. Adversaries can perform this behavior within virtualization/sandbox environments or natively on host systems.

Adversaries may utilize programmatic sleep commands or native system scheduling functionality, for example Scheduled Task/Job. Benign commands or other operations may also be used to delay malware execution or ensure prior commands have had time to execute properly. Loops or otherwise needless repetitions of commands, such as ping, may be used to delay malware execution and potentially exceed time thresholds of automated analysis environments.^[1],[2] Another variation, commonly referred to as API hammering, involves making various calls to Native API functions in order to delay execution (while also potentially overloading analysis environments with junk data).^[3],[4]

References

1. Loman, M. et al. (2021, July 4). Independence Day: REvil uses supply chain exploit to attack hundreds of businesses. Retrieved September 30, 2021.
2. Malik, A. (2016, October 14). Nitol Botnet makes a resurgence with evasive sandbox analysis technique. Retrieved September 30, 2021.
3. Joe Security. (2016, April 21). Nymaim - evading Sandboxes with API hammering. Retrieved September 30, 2021.
4. Joe Security. (2020, July 13). TrickBot's new API-Hammering explained. Retrieved September 30, 2021.

Saistītie uzdevumi

• MITREATTACK -

  EN: MITRE ATT&CK®, https://attack.mitre.org/. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. License: The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. See the Terms of Use for the disclaimers. ATT&CK® is a registered trademark of The MITRE Corporation. Converted into the GRCA format.

  DE: MITRE ATT&CK®, https://attack.mitre.org/. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE erlaubt die Nutzung für Forschung, Entwicklung und kommerzielle Zwecke, wenn jede Kopie den Urheberrechtsvermerk und die Lizenz enthält; maßgeblich ist der englische Wortlaut der Lizenz oben und die Terms of Use mit den Haftungsausschlüssen. ATT&CK® ist eine eingetragene Marke der MITRE Corporation. In das GRCA-Format umgewandelt.