Skip to content

Time Based Checks

Subtechnique · ATTACK:enterprise:T1497.003

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1497.003",
  "title": "Time Based Checks",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1497/003",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--4bed873f-0b7d-41d4-b93a-b6905d1f90b0",
  "external_id": "T1497.003",
  "domain": "enterprise",
  "created": "2020-03-06T21:11:11.225Z",
  "modified": "2026-05-12T15:12:00.630Z",
  "version": "3.0",
  "aliases": [

  ],
  "tactics": [
    "stealth",
    "discovery"
  ],
  "source_references": [
    {
      "source_name": "ISACA Malware Tricks",
      "url": "https://www.isaca.org/resources/isaca-journal/issues/2017/volume-6/evasive-malware-tricks-how-malware-evades-detection-by-sandboxes"
    }
  ]
}

Explicit source assertions (51)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0565 → uses → ATTACK:enterprise:T1497.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--00701b4a-9eab-41cc-9c09-f904a9799201

Symantec RAINDROP January 2021

ATTACK:enterprise:S0626 → uses → ATTACK:enterprise:T1497.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0550f254-d194-4f84-b005-b7a2cdc94a4e

Securelist APT10 March 2021

ATTACK:enterprise:S0559 → uses → ATTACK:enterprise:T1497.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0648b4df-ad84-4c94-8a0c-16e392f80f82

FireEye SUNBURST Backdoor December 2020

ATTACK:enterprise:S0574 → uses → ATTACK:enterprise:T1497.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--141036b9-327f-4b13-a561-856697dd138b

Unit42 BendyBear Feb 2021

ATTACK:enterprise:S0554 → uses → ATTACK:enterprise:T1497.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1492575f-9e3d-4ba0-ae2d-66711120adf6

JoeSecurity Egregor 2020

ATTACK:enterprise:S0611 → uses → ATTACK:enterprise:T1497.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1fb2a0f2-5d60-4b72-9d18-5d5d06d0c2fe

Unit42 Clop April 2021

ATTACK:enterprise:S0627 → uses → ATTACK:enterprise:T1497.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2426fc7d-5d97-4563-9889-d079ed36b4cf

Securelist APT10 March 2021

ATTACK:enterprise:S0660 → uses → ATTACK:enterprise:T1497.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--26802b94-95bf-4d01-a552-81069e62131a

Trend Micro DRBControl February 2020

ATTACK:enterprise:S0386 → uses → ATTACK:enterprise:T1497.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--281eabd3-1965-4b62-8862-1edb15d49701

TrendMicro Ursnif File Dec 2014

ATTACK:enterprise:S0439 → uses → ATTACK:enterprise:T1497.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2abdb5f5-6ff1-4f05-b925-429595011475

ESET Okrum July 2019

ATTACK:enterprise:S9003 → uses → ATTACK:enterprise:T1497.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2dc94895-c81e-4a83-865a-e53352f17395

Breakdev Evilginx 3.2 AUG 2023

ATTACK:enterprise:S0512 → uses → ATTACK:enterprise:T1497.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3056fa10-d4a3-4830-96b7-987b10b5ae70

ESET Dukes October 2019

ATTACK:enterprise:S1066 → uses → ATTACK:enterprise:T1497.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--323863fd-c133-45f4-9628-b09b039b7c31

Secureworks DarkTortilla Aug 2022

ATTACK:enterprise:S1141 → uses → ATTACK:enterprise:T1497.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--358df62a-ff30-43d1-a110-e9f61ae59a97

ESET Turla Lunar toolset May 2024

ATTACK:enterprise:S9042 → uses → ATTACK:enterprise:T1497.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--41744eb6-2c96-4627-b41e-2b23702b8dcb

Aikido TeamPCP Trivy MAR 2026

ATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1497.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--45eef730-8c5b-45fb-9cd9-c7998a764898

Proofpoint Bumblebee April 2022

ATTACK:enterprise:S9023 → uses → ATTACK:enterprise:T1497.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--47aabad4-fe76-47b4-9bd5-9874a992cacb

ESET HiddenFace 2024

ATTACK:enterprise:S0115 → uses → ATTACK:enterprise:T1497.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--53f5aaf3-b4de-4e31-bf50-a297bb8b61ca

Proofpoint Operation Transparent Tribe March 2016

ATTACK:enterprise:S1138 → uses → ATTACK:enterprise:T1497.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--55a12a15-04fc-49b9-b268-245cb4559bcf

Sophos Gootloader

ATTACK:enterprise:S1018 → uses → ATTACK:enterprise:T1497.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--56f3245a-b7dc-46a5-8454-7476e03fe772

Palo Alto Unit 42 OutSteel SaintBot February 2022

ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1497.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--57e7d8ef-33dd-4a08-bce2-e516a9662383

ClearSky Lazarus Aug 2020

ATTACK:enterprise:S0671 → uses → ATTACK:enterprise:T1497.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5970c81f-932b-47e9-a63b-b4e30c351e7f

Kaspersky Tomiris Sep 2021

ATTACK:enterprise:S0697 → uses → ATTACK:enterprise:T1497.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6c56fdb0-d6cc-4a25-aa19-7191410704ef

Crowdstrike DriveSlayer February 2022

ATTACK:enterprise:S0447 → uses → ATTACK:enterprise:T1497.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--76f712e1-cc4c-43a2-b6a7-c288ac206aac

Talos Lokibot Jan 2021

ATTACK:enterprise:S1086 → uses → ATTACK:enterprise:T1497.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7f152b13-3aae-4c67-b8f3-391cac671aed

Morphisec Snip3 May 2021

ATTACK:enterprise:S1212 → uses → ATTACK:enterprise:T1497.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8346e401-cf17-4693-a082-c030e1fecfcf

Group-IB RansomHub FEB 2025

ATTACK:enterprise:S0268 → uses → ATTACK:enterprise:T1497.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--88a798b0-0820-4a6e-a9b2-416c84f3b357

Kaspersky CactusPete Aug 2020 · Talos Bisonal Mar 2020

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1497.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--88f01e5a-26ce-4864-9402-bfaaf08dab61

LevelBlue_Vidar_May2026

ATTACK:enterprise:S1034 → uses → ATTACK:enterprise:T1497.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8aeea825-de75-404b-bde3-806ba749f416

Cybereason StrifeWater Feb 2022

ATTACK:enterprise:S0453 → uses → ATTACK:enterprise:T1497.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8f5e9158-1abe-4ed7-8a0a-df07f629aac8

Malwarebytes Pony April 2016

ATTACK:enterprise:S1132 → uses → ATTACK:enterprise:T1497.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9cd53236-9af0-4a36-8a4e-903b3673bb9e

SentinelOne Agrius 2021

ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1497.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9e07c247-c778-496d-9972-6581f2d10c93

Joe Sec Trickbot

ATTACK:enterprise:S1059 → uses → ATTACK:enterprise:T1497.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a03c46d1-763a-40e8-952b-36b27be11dda

SentinelLabs Metador Technical Appendix Sept 2022

ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1497.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a8e662f8-e644-44d8-8aca-79e8d7924826

Cyberint Qakbot May 2021 · Kaspersky QakBot September 2021

ATTACK:enterprise:S0513 → uses → ATTACK:enterprise:T1497.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ab4d7a1b-2b5a-44b6-a363-363d3f3f6e05

ESET Dukes October 2019

ATTACK:enterprise:S0632 → uses → ATTACK:enterprise:T1497.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ac04e244-5ab3-4ac7-8f5d-575ec8ff67f0

Group IB GrimAgent July 2021

ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1497.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--adbee939-28b3-4932-9e8d-992b7fdca835

NCC Group Team9 June 2020

ATTACK:enterprise:S0396 → uses → ATTACK:enterprise:T1497.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b29637f2-49be-4785-b82b-09661f25c42c

Cyphort EvilBunny Dec 2014

ATTACK:enterprise:S0642 → uses → ATTACK:enterprise:T1497.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b7f2b493-8c91-4793-8206-52d302906b2b

Accenture MUDCARP March 2019

ATTACK:enterprise:T1497.003 → subtechnique-of → ATTACK:enterprise:T1497

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bb1fb0c8-49f9-463c-b039-68636d507b80

ATTACK:enterprise:S1229 → uses → ATTACK:enterprise:T1497.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bbab58d1-29dd-4abd-8ba2-d13c357a7b31

Zscaler Havoc FEB 2023 · Havoc Framework Documentation

ATTACK:enterprise:S0493 → uses → ATTACK:enterprise:T1497.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bd289f02-1354-423e-b5e4-7aca35ec9d8a

Trustwave GoldenSpy June 2020

ATTACK:enterprise:S0689 → uses → ATTACK:enterprise:T1497.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--be51a4cd-8e2b-4605-9f8d-35e4689704f4

RecordedFuture WhisperGate Jan 2022 · Medium S2W WhisperGate January 2022

ATTACK:enterprise:S0694 → uses → ATTACK:enterprise:T1497.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c1db186f-0c57-4c10-b858-3ecc792bb224

ClearSky Lazarus Aug 2020

ATTACK:enterprise:S0588 → uses → ATTACK:enterprise:T1497.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cbc18998-67f4-493a-b0d3-4aa50da3c407

MSTIC NOBELIUM Mar 2021

ATTACK:enterprise:S0561 → uses → ATTACK:enterprise:T1497.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d231c64f-4a5f-43b8-a6e8-6ddd74d14eb3

Medium Eli Salem GuLoader April 2021

ATTACK:enterprise:S1064 → uses → ATTACK:enterprise:T1497.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--db2307cc-3e11-4b2f-83c8-be57371b9c51

HP SVCReady Jun 2022

ATTACK:enterprise:S1063 → uses → ATTACK:enterprise:T1497.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dec02920-c2d1-4340-a503-f6a38ae0b0f7

MDSec Brute Ratel August 2022 · Palo Alto Brute Ratel July 2022

ATTACK:enterprise:S0658 → uses → ATTACK:enterprise:T1497.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e1ee2aae-72b0-4258-abab-2705d6b9268a

trendmicro xcsset xcode project 2020

ATTACK:enterprise:S0595 → uses → ATTACK:enterprise:T1497.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e46888e6-8c13-4a9c-8638-f8c151bec3c6

wardle evilquest parti

ATTACK:enterprise:S0584 → uses → ATTACK:enterprise:T1497.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e5cb79c2-2bc0-47e2-be01-6bcf55d4c1a2

CISA AppleJeus Feb 2021

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.