216.73.216.169

T1497.003: T1497.003

View on MITRE ATT&CK The MITRE Corporation · Published 06/03/2020 22:11 · Modified 13/04/2026 17:17

Essential information

MITRE technique ID
T1497.003
Confidence
100/100
Revoked
No
Published
06/03/2020 22:11
Modified
13/04/2026 17:17
Author / Source
The MITRE Corporation

Aliases

Time Based Checks

Platforms

windows macos linux

Description

Adversaries may employ various time-based methods to detect virtualization and analysis environments, particularly those that attempt to manipulate time mechanisms to simulate longer elapses of time. This may include enumerating time-based properties, such as uptime or the system clock. Adversaries may use calls like `GetTickCount` and `GetSystemTimeAsFileTime` to discover if they are operating within a virtual machine or sandbox, or may be able to identify a sandbox accelerating time by sampling and calculating the expected value for an environment's timestamp before and after execution of a sleep function.(Citation: ISACA Malware Tricks)

Kill chain phases

Kill chainPhase
mitre-attack defense-evasion
mitre-attack discovery

Marking (TLP)

TLP:CLEAR Copyright 2015-2025, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.

External references

Related entities

Intrusion sets, malware, reports, vulnerabilities, indicators and other entities linked to this technique.