tfMITRE ATT&CK technique

Delay Execution T1678

Tactic: Stealth
Platforms: Linux, macOS, Windows
Version: 2.0
Created: 24 September 2025
Last modified: 12 May 2026
Contributors: Deloitte Threat Library Team; Jeff Felling, Red Canary; Jorge Orchilles, SCYTHE; Ruben Dodge, @shotgunner101

Adversaries may employ various time-based methods to evade detection and analysis. These techniques often exploit system clocks, delays, or timing mechanisms to obscure malicious activity, blend in with benign activity, and avoid scrutiny. Adversaries can perform this behavior within virtualization/sandbox environments or natively on host systems.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups56th pct

Threat groups56th percentile · 56% of ATT&CK techniques have this many threat groups attributed or fewer.

Campaigns72nd pct

Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malwareTop 20%

Tools & malware80th percentile · 80% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Delay Execution MITRE reference T1678

56th pctamong all ATT&CK techniques for number of groups

2 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Mustang PandaG0129 ↗

Has delayed the execution of payloads leveraging ping echo requests cmd /c ping 8.8.8.8 -n 70&&"%temp%\<legitimate executable>".1 2

created 2021-04-122 referencesaka TA416

KimsukyG0094 ↗

Has utilized the Sleep function to ensure execution of scripts.1 2

created 2019-08-262 referencesaka Black Banshee

All 2 groups for this technique

17 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

TeamPCP Cloud StealerS9041 ↗

Has leveraged a persistence script that will sleep for five minutes before additional execution.1 2 3

created 2026-07-01MALWAREcarried by 1 group

DynoWiperS9038 ↗

Has utilized a five-second delay using Sleep(5000) between two of the three phases of the attack that involves file overwriting, file deletion, and system reboot.1 2

created 2026-04-22MALWARE

RustyWaterS9037 ↗

Has generated random sleep intervals between C2 communication.1

created 2026-04-21MALWAREcarried by 1 group

FooderS9033 ↗

Has used a custom delay function (delayExecution(integer)) and Sleep API calls (Sleep(integer)) to slow code execution.1   

created 2026-04-20MALWAREcarried by 1 group

MuddyViperS9032 ↗

Has the ability to sleep for a certain amount of time, with the default being one minute.1    

created 2026-04-20MALWAREcarried by 1 group

AshTagS9031 ↗

Can use a set sleep time to delay C2 beaconing.1

created 2026-04-20MALWAREcarried by 1 group

All 17 software entries for this technique · 6 newest in this preview

Offense vs defense T1678

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Delay Execution detection strategy DET0372

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Multi-Platform Detection Strategy for T1678 - Delay Execution

Enterprise

3 platforms

AN1048 · Windows

Correlated use of sleep/delay mechanisms (e.g., kernel32!Sleep, NTDLL APIs) in short-lived processes, combined with parent processes invoking suspicious scripts (e.g., wscript, powershell) with minimal user interaction.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Module LoadDC0016	WinEventLog:Sysmon	EventCode=7
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Delay duration that distinguishes benign scripts from evasive behavior.
ParentProcessName	Legitimate parent-child combinations may differ across environments.
SleepFunctionPattern	Different APIs may be used to invoke sleep (e.g., Sleep, NtDelayExecution).

AN1049 · Linux

Shell scripts or binaries invoking repeated 'sleep', 'ping', or low-level syscalls (e.g., nanosleep) in short-lived execution chains with no user or system interaction. Frequently seen in malicious cron jobs or payload stagers.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Script ExecutionDC0029	auditd:PROCTITLE	scripting loop invoking sleep/ping
Process CreationDC0032	auditd:SYSCALL	execve or nanosleep with no stdout/stderr I/O

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
CommandLineRegex	Environment-specific delay scripts may vary (sleep 300, ping -n 60, etc.).
TimeBetweenSyscalls	Threshold for determining if delay is artificially extended.
UserContext	Root vs. service user context alters risk profile.

AN1050 · macOS

Execution of AppleScript, bash, or launchd jobs that invoke delay functions (e.g., sleep, delay in AppleScript) with limited parent interaction and staged follow-on commands.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Module LoadDC0016	macos:unifiedlog	delay/sleep library usage in user context
Process CreationDC0032	macos:unifiedlog	launchd or osascript spawns process with delay command

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ScriptPattern	AppleScript vs shell scripts differ per threat and org.
UserContext	Execution under user vs daemon context changes severity.
DelayDurationThreshold	Amount of delay that distinguishes benign usage vs evasion.

Delay Execution detections T1678

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs