T1497.003 - Time Based Checks - MITRE ATT&CK

T1497.003 - Time Based Checks

Sub-technique

Tactics:
Defense Evasion Discovery

Platforms:
Linux macOS Windows

Detection:
Not specified

Description:

Adversaries may employ various time-based methods to detect virtualization and analysis environments, particularly those that attempt to manipulate time mechanisms to simulate longer elapses of time. This may include enumerating time-based properties, such as uptime or the system clock.

Adversaries may use calls like `GetTickCount` and `GetSystemTimeAsFileTime` to discover if they are operating within a virtual machine or sandbox, or may be able to identify a sandbox accelerating time by sampling and calculating the expected value for an environment's timestamp before and after execution of a sleep function.(Citation: ISACA Malware Tricks)

Malware (20)

TrickBot other Bumblebee other Ursnif other RansomHub other Havoc other Pony other Crimson other Tomiris other Gootloader other Snip3 other GuLoader other WhisperGate other Okrum other Raindrop other FatDuke other DRATzarus other BADFLICK other GoldMax other DarkTortilla other Bisonal other

Metadata

MITRE ID:	T1497.003
STIX ID:	attack-pattern--4bed873f-0b7d-...
Platforms:	Linux, macOS, Windows
Created:	13/01/2026 17:48
Updated:	06/03/2026 16:00