Procedure examples

GoldMax has set an execution trigger date and time, stored as an ASCII Unix/Epoch time value.

DarkTortilla can implement the `kernel32.dll` Sleep function to delay execution for up to 300 seconds before implementing persistence or processing an addon package.

Bisonal has checked if the malware is running in a virtual environment with the anti-debug function GetTickCount() to compare the timing.

Clambling can wait 30 minutes before initiating contact with C2.

SVCReady can enter a sleep stage for 30 minutes to evade detection.

ThiefQuest invokes time call to check the system's time, executes a sleep command, invokes a second time call, and then compares the time difference between the two time calls and the amount of time the system slept to identify the sandbox.

Saint Bot has used the command `timeout 20` to pause the execution of its initial loader.

P8RAT has the ability to "sleep" for a specified time to evade detection.

BendyBear can check for analysis environments and signs of debugging using the Windows API kernel32!GetTickCountKernel32 call.

SodaMaster has the ability to put itself to "sleep" for a specified time.

LiteDuke can wait 30 seconds before executing additional code if security software is detected.

Bazar can use a timer to delay execution of core functionality.

HiddenFace can sleep randomly between 30 and 60 seconds to avoid behavioral analysis.

HermeticWiper has the ability to receive a command parameter to sleep prior to carrying out destructive actions on a targeted host.

SUNBURST remained dormant after initial access for a period of up to two weeks.

EvilBunny has used time measurements from 3 different APIs before and after performing sleep operations to check and abort if the malware is running in a sandbox.

IPsec Helper will sleep for a random number of seconds, iterating 200 times over sleeps between one to three seconds, before continuing execution flow.

GoldenSpy's installer has delayed installation of GoldenSpy for two hours after it reaches a victim system.

GrimAgent can sleep for 195 - 205 seconds after payload execution and before deleting its task.

Clop has used the sleep command to avoid sandbox detection.

Lokibot has performed a time-based anti-debug check before downloading its third stage.

Egregor can perform a long sleep (greater than or equal to 3 minutes) to evade detection.

metaMain has delayed execution for five to six minutes during its persistence establishment process.

LunarWeb can pause for a number of hours before entering its C2 communication loop.

Using the machine's local time, XCSSET waits 43200 seconds (12 hours) from the initial creation timestamp of a specific file, .report. After the elapsed time, XCSSET executes additional modules.

AppleJeus has waited a specified time before downloading a second stage payload.

The QakBot dropper can delay dropping the payload to evade detection.

StrifeWater can modify its sleep time responses from the default of 20-22 seconds.

evilginx2 has the ability to hide phishing lures for a set time to avoid scanning by sandboxes.

Brute Ratel C4 can call `NtDelayExecution` to pause execution.

CanisterWorm has leveraged a Sleep setting of five minutes before executing tasks to evade sandbox environments.

BADFLICK has delayed communication to the actor-controlled IP address by 5 minutes.

In 2016, APT28 conducted a distributed denial of service (DDoS) attack against the World Anti-Doping Agency.

Lucifer can execute TCP, UDP, and HTTP denial of service (DoS) attacks.

NKAbuse enables multiple types of network denial of service capabilities across several protocols post-installation.

Sandworm Team temporarily disrupted service to Georgian government, non-government, and private sector websites after compromising a Georgian web hosting provider in 2019.

OnionDuke has the capability to use a Denial of Service module.

ZxShell has a feature to perform SYN flood attack on a host.

Industroyer uses a custom DoS tool that leverages CVE-2015-5374 and targets hardcoded IP addresses of Siemens SIPROTEC devices.

During the 2016 Ukraine Electric Power Attack, Sandworm Team used various MS-SQL stored procedures.

Stuxnet used xp_cmdshell to store and execute SQL code.

LightNeuron has used a malicious Microsoft Exchange transport agent for persistence.

FrostyGoop Incident deployed a ReGeorg variant web shell to impacted systems following initial access for persistence.

During SharePoint ToolShell Exploitation, threat actors followed exploitation of SharePoint servers with installation of a malicious .aspx web shell (spinstall0.aspx) that was written to the `_layouts/15/` directory, granting persistent HTTP-based access.

During Cutting Edge, threat actors used multiple web shells to maintain presence on compromised Connect Secure appliances such as WIREFIRE, GLASSTOKEN, BUSHWALK, LIGHTWIRE, and FRAMESTING.

During Operation Digital Eye, threat actors deployed a PHP-based webshell to maintain persistent access.

For HomeLand Justice, threat actors used .aspx webshells named pickers.aspx, error4.aspx, and ClientBin.aspx, to maintain persistence.

During the C0032 campaign, TEMP.Veles planted Web shells on Outlook Exchange servers.

During Operation CuckooBees, the threat actors generated a web shell within a vulnerable Enterprise Resource Planning Web Application Server as a persistence mechanism.

APT41 DUST involved use of web shells such as ANTSWORD and BLUEBEAM for persistence.