TA0005 · DEFENSE EVASION
Time Based Evasion
Adversaries may employ various time-based methods to detect and avoid virtualization and analysis environments.
Detect it with
Time-based evasion will likely occur in the first steps of an operation but may also occur throughout as an adversary learns the environment.
Why it matters on shift
Time Based Evasion is one of the concrete ways adversaries achieve defense evasion. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After defense evasion, the next tactic is usually Credential Access. Search your telemetry for the transition before closing the ticket.
Kill-chain context