Time Based Sandbox Evasion via Long Sleep Call

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•3

This rule detects potential sandbox evasion techniques by identifying HTTP responses containing a 'Sleep(' function call with a duration of 1,000,000 milliseconds (1000 seconds) or more. This long sleep duration is often used by malware to delay execution and bypass time-based sandboxes, which typically have limited execution times for analysis.