Loopback ping or timeout used as an execution delay

Siemphony@siemphonylowT1497.003unverified

Matches the one delay primitive AN0396 names by example that leaves a process behind — a ping aimed at the loopback address — and the closely related timeout.exe run with the /nobreak switch, chosen here rather than named by the analytic, as the visible half of the sleep loops malware uses to outlast a sandbox's analysis window. A ping to 127.0.0.1, localhost or ::1 has no connectivity purpose, and that is what separates a deliberate wait from the ordinary reachability check ping is otherwise used for; /nobreak is the equivalent gate on timeout, since suppressing the keypress exit is what turns it into a fixed delay. The analytic's SleepDurationThreshold knob cannot be applied: no construct available here compares the numeric argument, so a two-second wait and a twenty-minute one match identically, and delays taken in-process through Sleep or WaitForSingleObject — which the same analytic mentions — create no process at all and are invisible to this log source. Where this category is fed by Security EventID 4688 rather than Sysmon EventID 1, both Audit Process Creation and the separate Include command line in process creation events policy must be enabled, or CommandLine is empty and the rule matches nothing while looking healthy. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0141, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((FolderPath endswith "\\ping.exe" and (ProcessCommandLine contains "127.0.0.1" or ProcessCommandLine contains "localhost" or ProcessCommandLine contains "::1")) or (FolderPath endswith "\\timeout.exe" and (ProcessCommandLine contains "-nobreak" or ProcessCommandLine contains "/nobreak" or ProcessCommandLine contains "–nobreak" or ProcessCommandLine contains "—nobreak" or ProcessCommandLine contains "―nobreak")))

Splunk · SPL

Run this as a search.

index=* ((Image="*\\ping.exe" AND (CommandLine="*127.0.0.1*" OR CommandLine="*localhost*" OR CommandLine="*::1*")) OR (Image="*\\timeout.exe" AND (CommandLine="*-nobreak*" OR CommandLine="*/nobreak*" OR CommandLine="*–nobreak*" OR CommandLine="*—nobreak*" OR CommandLine="*―nobreak*")))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.executable) LIKE "*\\\\ping.exe" AND (TO_LOWER(process.command_line) LIKE "*127.0.0.1*" OR TO_LOWER(process.command_line) LIKE "*localhost*" OR TO_LOWER(process.command_line) LIKE "*::1*")) OR (TO_LOWER(process.executable) LIKE "*\\\\timeout.exe" AND (TO_LOWER(process.command_line) LIKE "*-nobreak*" OR TO_LOWER(process.command_line) LIKE "*/nobreak*" OR TO_LOWER(process.command_line) LIKE "*–nobreak*" OR TO_LOWER(process.command_line) LIKE "*—nobreak*" OR TO_LOWER(process.command_line) LIKE "*―nobreak*")))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 2 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)\\ping\.exe$</field>    <field name="CommandLine" type="pcre2">(?i)(127\.0\.0\.1|localhost|::1)</field>    <description>Loopback ping or timeout used as an execution delay (1/2)</description>    <mitre>      <id>T1497.003</id>    </mitre>  </rule>   <rule id="100001" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)\\timeout\.exe$</field>    <field name="CommandLine" type="pcre2">(?i)(-nobreak|/nobreak|–nobreak|—nobreak|―nobreak)</field>    <description>Loopback ping or timeout used as an execution delay (2/2)</description>    <mitre>      <id>T1497.003</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: low
Category: discovery_recon
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 39035d78-d0de-4b17-a6e3-5e1eb7c72f20

ATT&CKT1497.003

T1497.003Time Based Checks

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessondiscovery recon

discovery reconAI draft — unreviewed

01 · What this rule detects

Sandbox-aware malware often stalls before doing anything interesting, betting the analysis window closes first. This rule catches the stalls that leave a process behind on Windows: ping.exe aimed at the loopback address, and timeout.exe run with /nobreak. MITRE's AN0396 names "Sleep, ping -n loops, WaitForSingleObject" as the delay primitives; only the ping loop creates a process, so it is the one of the three this log source can see. timeout.exe is the pipeline's own addition — the analytic never mentions it — included because it is the same idiom wearing a different binary.

02 · Telemetry you need

Windows process creation: category: process_creation, product: windows, taken verbatim from the brief's Sysmon EventID 1 source. The rule reads two fields, Image and CommandLine. If your process-creation pipeline is fed by Security EventID 4688 rather than Sysmon, both Audit Process Creation and the separate Include command line in process creation events policy must be enabled. Neither is on by default or in the MS/CIS baselines, and without the second one CommandLine arrives empty — the rule then matches nothing while every dashboard shows it healthy.

03 · How the logic works

Two selections joined by condition: 1 of selection*. selection_ping_loopback requires Image|endswith: '\ping.exe' and CommandLine|contains one of 127.0.0.1, localhost, ::1. The Image gate stops the rule matching any command line that merely mentions localhost; the address list is what separates a deliberate wait from an ordinary reachability check, since pinging yourself proves nothing about the network. selection_timeout_nobreak requires Image|endswith: '\timeout.exe' and CommandLine|contains|windash: '/nobreak'. The windash modifier makes /nobreak, -nobreak and the Unicode dash variants all match. Suppressing the keypress exit is what turns timeout into a fixed delay, so it is the discriminator rather than the /t value. Two MITRE knobs are out of reach. SleepDurationThreshold would compare the numeric argument, and no construct available here does numeric comparison — a two-second wait and a twenty-minute one match identically. TimeBetweenExecutionAndNextStage, the correlation between the delay and whatever runs after it, is the analytic's actual discriminator, and aggregation is barred too. So a match is a candidate to pair with a later event on the same host, not an alert on its own.

04 · Common false positives

Very. The loopback ping is still the standard sleep in .bat and .cmd files, so installers, updaters and uninstallers waiting on a service stop or a file lock will be the highest-volume match by a wide margin. Behind them: deployment task sequences pausing with timeout /t 30 /nobreak between reboot-sensitive steps, logon and maintenance scripts retrying a mapped drive, and vendor health checks pinging localhost to confirm the TCP/IP stack answers. The rule ships at level: low for exactly that reason.

05 · Detection maturity

tier_1: Lowest tier, and it stays there until someone runs it. This rule was authored from a MITRE scaffold and has never been executed against a single log line: there is no true-positive example, no measured false-positive rate, no volume estimate. It renders in all four backends, which establishes only that the syntax is valid. Run it as a hunt over a week of your own telemetry, count what returns, and those numbers become the first real evidence anyone has about it.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Baseline first, then subtract. Add ParentImage and exclude your deployment agent, management stack and known installer chains — the parent is the cheapest discriminator available. Scope out the change windows your task sequences run in. UserContext, MITRE's third knob, is worth applying by hand: a SYSTEM-context delay under a management agent is routine, the same delay parented by a user's Office process is not. Know the gaps before you read silence as safety — ping 127.1, ping 0x7f000001, and a timing ping aimed at a routable address all slip past.

Declared by the author

Software installer, updater and uninstaller batch wrappers that wait for a service stop or a file lock to clear with a loopback ping, still the standard sleep idiom in .bat and .cmd files. On any fleet with routine software deployment this is the highest-volume match by a wide margin and should be scoped out by parent or by deployment window before the rule is alerted on.
Configuration-management and OS deployment task sequences that pause between reboot-sensitive steps with timeout /t 30 /nobreak, which fires once per step on every managed host each time the sequence runs.
Logon, logoff and scheduled maintenance scripts that pause with a loopback ping before retrying a mapped drive, printer or network share connection.
Vendor diagnostic and health-check scripts that ping localhost to confirm the local TCP/IP stack is responding before running further tests.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1497.003, evaluated against their process_creation events.

Share this rule

/u/siemphony/39035d78-d0de-4b17-a6e3-5e1eb7c72f20

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Loopback ping or timeout used as an execution delay

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it