MITRE ATT&CK technique · stealth, Discovery

`T1497.003` Time Based Checks

Sub-technique of T1497 Virtualization/Sandbox Evasion

Adversaries may employ various time-based methods to detect virtualization and analysis environments, particularly those that attempt to manipulate time mechanisms to simulate longer elapses of time. This may include enumerating time-based properties, such as uptime or the system clock. Adversaries may use calls like `GetTickCount` and `GetSystemTimeAsFileTime` to discover if they are operating…

MITRE ATT&CK page ↗

Who uses it · with stories on Jábega

Clop

Sigma rules to hunt it

SigmaHQ has no rules for this technique.

Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.