Mustang PandaG0129 ↗
Has delayed the execution of payloads leveraging ping echo requests cmd /c ping 8.8.8.8 -n 70&&"%temp%\<legitimate executable>".12
tfMITRE ATT&CK technique
Delay Execution T1678
- Tactic
- Stealth
- Platforms
- Linux, macOS, Windows
- Version
- 2.0
- Created
- 24 September 2025
- Last modified
- 12 May 2026
- Contributors
- Deloitte Threat Library Team; Jeff Felling, Red Canary; Jorge Orchilles, SCYTHE; Ruben Dodge, @shotgunner101
Adversaries may employ various time-based methods to evade detection and analysis. These techniques often exploit system clocks, delays, or timing mechanisms to obscure malicious activity, blend in with benign activity, and avoid scrutiny. Adversaries can perform this behavior within virtualization/sandbox environments or natively on host systems.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
2
Threat groups56th pct
Threat groups56th percentile · 46% of ATT&CK techniques have fewer threat groups attributed.1
Campaigns72nd pct
Campaigns72nd percentile · 54% of ATT&CK techniques have fewer campaigns recorded.17
Tools & malwareTop 20%
Tools & malware80th percentile · 79% of ATT&CK techniques have fewer tools implementing them.0
Detection rulesNone recorded
Detection rulesNone recorded · 32% of ATT&CK techniques have none either.