T1497.003sub-technique of T1497 Virtualization/Sandbox Evasion

Time Based Checks

Linux · macOS · Windowsnothing on this site yetT1497.003 on attack.mitre.org

Adversaries may employ various time-based methods to detect virtualization and analysis environments, particularly those that attempt to manipulate time mechanisms to simulate longer elapses of time. This may include enumerating time-based properties, such as uptime or the system clock.
MITRE ATT&CK 19.2, retrieved 2026-09-12

how MITRE says to see it

Detect Time-Based Evasion via Sleep, Timer Loops, and Delayed Execution

Process creation involving suspicious delays (e.g., Sleep, ping -n loops, WaitForSingleObject), followed by sensitive system access or lateral movement behaviors.
Script-based execution of sleep loops or time delay commands (e.g., sleep, ping delay, while-loops) followed by file creation or network connections.
Use of `usleep`, `nanosleep`, or `NSTimer` calls in executables or binaries with no GUI interaction, especially followed by disk/network activity.

the rest of T1497

T1497.001 System Checks · not covered yet
T1497.002 User Activity Based Checks · not covered yet

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.