W32tm Used as Delay Mechanism
This rule detects the use of 'w32tm.exe' with specific command-line arguments that allow it to act as a delay mechanism. Adversaries may leverage this legitimate Windows utility to introduce delays in their execution, potentially for sandbox evasion or to time their activities. The detected command-line arguments include '/stripchart', '/computer:', '/period:', '/dataonly', and '/samples:'.
Sigma
