DragonReturn Anti-Sandbox Timing Check via GetTickCount64 Loop

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

This rule monitors for processes that repeatedly call GetTickCount64 while also invoking sleep functions, a common technique used by malware to detect virtualized environments or sandboxes by measuring time intervals and stalling execution to bypass short-duration automated analysis. The rule prioritizes alerts originating from non-standard system paths or processes.