MITRE ATT&CKsub-technique

T1497.003 Time Based Checks

Published 2020-03-06 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Stealth, Discovery
Platforms
Linux, macOS, Windows
Version
3.0
Created
2020-03-06

Description

Adversaries may employ various time-based methods to detect virtualization and analysis environments, particularly those that attempt to manipulate time mechanisms to simulate longer elapses of time. This may include enumerating time-based properties, such as uptime or the system clock. Adversaries may use calls like `GetTickCount` and `GetSystemTimeAsFileTime` to discover if they are operating within a virtual machine or sandbox, or may be able to identify a sandbox accelerating time by sampling and calculating the expected value for an environment's timestamp before and after execution of a sleep function.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1497 Virtualization/Sandbox Evasion technique

Tactic · MITRE ATT&CK (2)

Referenced by MITRE ATT&CK · uses (50)

  • S9050 Vidar software (malware)
  • S9042 CanisterWorm software (malware)
  • S9023 HiddenFace software (malware)
  • S9003 evilginx2 software (tool)
  • S1229 Havoc software (malware)
  • S1212 RansomHub software (malware)
  • S1141 LunarWeb software (malware)
  • S1138 Gootloader software (malware)
  • S1132 IPsec Helper software (malware)
  • S1086 Snip3 software (malware)
  • C0022 Operation Dream Job campaign
  • S1066 DarkTortilla software (malware)
  • S1064 SVCReady software (malware)
  • S1063 Brute Ratel C4 software (tool)
  • S1059 metaMain software (malware)
  • S1039 Bumblebee software (malware)
  • S1034 StrifeWater software (malware)
  • S1018 Saint Bot software (malware)
  • S0697 HermeticWiper software (malware)
  • S0694 DRATzarus software (malware)
  • S0689 WhisperGate software (malware)
  • S0671 Tomiris software (malware)
  • S0660 Clambling software (malware)
  • S0658 XCSSET software (malware)
  • S0650 QakBot software (malware)
  • S0642 BADFLICK software (malware)
  • S0632 GrimAgent software (malware)
  • S0626 P8RAT software (malware)
  • S0627 SodaMaster software (malware)
  • S0611 Clop software (malware)
Show all 50 ›

References