Prolonged process dormancy before network activity (sandbox-evasion sleep)

Emiliano Mema@Nosalva

•updated Jul 9, 2026•0•0•6

This rule identifies processes that initiate network connections with a significant time delay (greater than 300 seconds) after the process was initially created. This pattern of delayed connection can be indicative of C2 beaconing behavior, where malware sleeps for a period of time before attempting to check in with a command-and-control server.