{"id":"T1678","name":"Delay Execution","url":"https://attack.mitre.org/techniques/T1678","tactics":["stealth"],"platforms":["Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0372","stix_id":"x-mitre-detection-strategy--e98d37af-727b-44a7-a72b-cdcf8a481a12","name":"Multi-Platform Detection Strategy for T1678 - Delay Execution","url":"https://attack.mitre.org/detectionstrategies/DET0372","analytics":[{"id":"AN1048","stix_id":"x-mitre-analytic--28e26a6a-e470-4f1c-845f-f2cbd816a1f7","name":"Analytic 1048","description":"Correlated use of sleep/delay mechanisms (e.g., kernel32!Sleep, NTDLL APIs) in short-lived processes, combined with parent processes invoking suspicious scripts (e.g., wscript, powershell) with minimal user interaction.","url":"https://attack.mitre.org/detectionstrategies/DET0372#AN1048","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=7","data_component":"DC0016","data_component_name":"Module Load","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"TimeWindow","description":"Delay duration that distinguishes benign scripts from evasive behavior."},{"field":"ParentProcessName","description":"Legitimate parent-child combinations may differ across environments."},{"field":"SleepFunctionPattern","description":"Different APIs may be used to invoke sleep (e.g., Sleep, NtDelayExecution)."}],"live":true,"detection_strategies":["DET0372"],"techniques":["T1678"]},{"id":"AN1049","stix_id":"x-mitre-analytic--dcc422d4-90fc-4e2a-afd5-b4fbc3d6c4a1","name":"Analytic 1049","description":"Shell scripts or binaries invoking repeated 'sleep', 'ping', or low-level syscalls (e.g., nanosleep) in short-lived execution chains with no user or system interaction. Frequently seen in malicious cron jobs or payload stagers.","url":"https://attack.mitre.org/detectionstrategies/DET0372#AN1049","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"execve or nanosleep with no stdout/stderr I/O","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"},{"name":"auditd:PROCTITLE","channel":"scripting loop invoking sleep/ping","data_component":"DC0029","data_component_name":"Script Execution","log_source_slug":"auditd-proctitle"}],"mutable_elements":[{"field":"CommandLineRegex","description":"Environment-specific delay scripts may vary (sleep 300, ping -n 60, etc.)."},{"field":"TimeBetweenSyscalls","description":"Threshold for determining if delay is artificially extended."},{"field":"UserContext","description":"Root vs. service user context alters risk profile."}],"live":true,"detection_strategies":["DET0372"],"techniques":["T1678"]},{"id":"AN1050","stix_id":"x-mitre-analytic--94871740-e9ae-458a-9d09-ef0f58c05905","name":"Analytic 1050","description":"Execution of AppleScript, bash, or launchd jobs that invoke delay functions (e.g., sleep, delay in AppleScript) with limited parent interaction and staged follow-on commands.","url":"https://attack.mitre.org/detectionstrategies/DET0372#AN1050","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"launchd or osascript spawns process with delay command","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-unifiedlog"},{"name":"macos:unifiedlog","channel":"delay/sleep library usage in user context","data_component":"DC0016","data_component_name":"Module Load","log_source_slug":"macos-unifiedlog"}],"mutable_elements":[{"field":"ScriptPattern","description":"AppleScript vs shell scripts differ per threat and org."},{"field":"UserContext","description":"Execution under user vs daemon context changes severity."},{"field":"DelayDurationThreshold","description":"Amount of delay that distinguishes benign usage vs evasion."}],"live":true,"detection_strategies":["DET0372"],"techniques":["T1678"]}],"live":true,"version":"1.0","techniques":["T1678"]}],"sigma_rules":[],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}