CyberStack

MITRE ATT&CK / Techniques / T1497.003

Virtualization/Sandbox Evasion: Time Based Checks

ID
T1497.003
Tactics
TA0005 Stealth, TA0007 Discovery
Sub-technique of
T1497 Virtualization/Sandbox Evasion
Platforms
Linux, macOS, Windows
Data sources
Process Creation, Module Load, File Metadata, OS API Execution
Source
attack.mitre.org
MITRE last modified
12 May 2026

Adversaries may employ various time-based methods to detect virtualization and analysis environments, particularly those that attempt to manipulate time mechanisms to simulate longer elapses of time. This may include enumerating time-based properties, such as uptime or the system clock.

Adversaries may use calls like GetTickCount and GetSystemTimeAsFileTime to discover if they are operating within a virtual machine or sandbox, or may be able to identify a sandbox accelerating time by sampling and calculating the expected value for an environment's timestamp before and after execution of a sleep function.[1]

Detection

Software (49)

References

  1. ISACA Malware Tricks