Time-Based Evasion Techniques

Overview

Time-Based Evasion Techniques involve adversaries manipulating or exploiting timing mechanisms to avoid detection and analysis during cyber attacks. These techniques are employed across various stages of the attack lifecycle to delay or disrupt defensive responses, enabling attackers to maintain stealth and persistence within targeted environments.

Attack Objective

• Achieve stealth and evade detection by security controls
• Support stages including Execution, Persistence, Defense Evasion, and Command & Control
• Advance attacker position by reducing visibility and prolonging unauthorized access

How the Technique Works

Adversaries leverage timing-based behaviors such as delaying execution, scheduling actions at specific times, or detecting system time to evade automated analysis and monitoring. By aligning malicious activity with periods of low monitoring or by introducing time delays, attackers reduce the likelihood of triggering alerts or sandbox detections, thereby increasing operational longevity.

Common Methods & Variations

• Use of sleep or wait commands to delay payload execution
• Scheduling tasks or processes to run at specific times or intervals
• Checking system clock or time zone to avoid execution in analysis environments
• Time-based triggers in cloud functions or identity sessions
• Living-off-the-land techniques utilizing native scheduling tools (e.g., cron, Task Scheduler)
• Custom tooling embedding timing logic to bypass sandbox timeouts

Indicators of Compromise (IOCs)

• Unusual or unexpected scheduled tasks and job creations
• Logs showing delayed or timed execution of processes
• Behavioral anomalies such as long sleep intervals preceding malicious activity
• Network activity patterns correlating with specific time windows
• Cloud audit logs indicating time-based function invocations

Detection Strategies

• Monitoring task scheduling systems and job creation events
• Behavioral analytics to identify abnormal delays or timing patterns
• Correlation of process start times with known maintenance or low-activity periods
• Use of telemetry from endpoint, network, and cloud sources to detect timing anomalies
• Combining signature-based detection with heuristic analysis for time-based evasion

Mitigation & Prevention

• Restrict permissions for creating or modifying scheduled tasks and jobs
• Implement strict time synchronization and monitoring policies
• Use endpoint detection and response (EDR) tools with behavioral analysis capabilities
• Apply least privilege principles to reduce attacker ability to manipulate timing mechanisms
• Configure alerting for unusual scheduling activities or time-based triggers

Response Considerations

• Immediate identification and disabling of suspicious scheduled tasks or delayed executions
• Comprehensive investigation of time-correlated events and process chains
• Review and harden scheduling and timing configurations post-incident
• Enhance monitoring around time-based triggers to prevent recurrence

Related Techniques

• Defense Evasion techniques such as Obfuscated Files or Information
• Persistence methods involving scheduled tasks or services
• Command and Control techniques using timed beaconing or delayed callbacks
• Execution techniques that rely on delayed or conditional execution

Mapping & References

• MITRE ATT&CK Tactic References: Defense Evasion, Persistence, Execution, Command and Control
• Relevant Techniques: Scheduled Task/Job (T1053), Indicator Removal on Host (T1070), Execution Guardrails (T1480)
• Public research and advisories on timing-based evasion and sandbox evasion strategies