AN0396
Analytic 0396
Windows
Process creation involving suspicious delays (e.g., Sleep, ping -n loops, WaitForSingleObject), followed by sensitive system access or lateral movement behaviors.
WinEventLog:Sysmon
EventCode=1
WinEventLog:Sysmon
EventCode=7
[SleepDurationThreshold]
Defines maximum allowable sleep duration in milliseconds before triggering anomaly detection.
[TimeBetweenExecutionAndNextStage]
Temporal window between initial process and next stage (e.g., lateral movement or persistence), used to correlate dormant activity.
[UserContext]
Whether the activity occurs in SYSTEM or user context may affect legitimacy scoring.
AN0397
Analytic 0397
Linux
Script-based execution of sleep loops or time delay commands (e.g., sleep, ping delay, while-loops) followed by file creation or network connections.
auditd:SYSCALL
execve of sleep or ping command within script interpreted by bash/python
auditd:SYSCALL
file write after sleep delay
[SleepLoopCount]
Defines how many loop iterations or sleep cycles are considered anomalous in the monitored environment.
[ExecutionScriptType]
Identifies which scripting interpreter is used (e.g., bash, python, perl) to adjust detection logic.
AN0398
Analytic 0398
macOS
Use of `usleep`, `nanosleep`, or `NSTimer` calls in executables or binaries with no GUI interaction, especially followed by disk/network activity.
macos:unifiedlog
application logs referencing NSTimer, sleep, or launchd delays
WinEventLog:Sysmon
EventCode=1
[AppBundleIdentifier]
Correlate with known/expected signed apps vs. unsigned binaries to reduce noise.
[TimeToNextEvent]
Minimum time expected between process start and observable I/O for normal apps.