Long Sleep/Delay Command in PowerShell Spawned by mshta.exe

Ankit Mehta@Secvyn

•updated Sep 20, 2026•0•0•2

Detects the use of PowerShell's Start-Sleep cmdlet with a duration of 3 minutes or longer within process command lines. This technique is commonly used by malware, such as ClickFix-style droppers, to bypass sandbox time-based analysis by delaying execution until the sandbox timeout period has elapsed.