A county SOC investigates malware on a municipal workstation that appeared dormant until automated sandbox analysis timers elapsed. Which evasion class best describes that behavior?
Select an answer to reveal the explanation.
Short Explanation
Some malware sits quietly until the sandbox gets bored and moves on—then it wakes up on a real desk. That delay trick is anti-analysis, not a phishing email theme by itself. Hunters should flag time-based sandbox evasion in the ticket.
Full Explanation
Malware on a municipal workstation that appears dormant until automated sandbox analysis timers elapse best matches anti-sandbox delayed execution intended to outwait automated analysis. The sample withholds malicious behavior until it believes it is on a real user endpoint rather than a short-lived detonation environment. County SOCs should tag time-based sandbox evasion explicitly so hunters extend analysis windows, use user-activity simulation, and correlate delayed post-detonation behaviors.
Spear-phishing pretexting against the county clerk is an initial-access social-engineering theme, not the dormancy-until-timer behavior described. Certificate pinning on the city's public website is a transport-security design choice unrelated to malware sleeping through sandbox timers. Legitimate Windows Update deferral policies approved by change control are administrative patch timing decisions, not malware anti-analysis tradecraft.
Exam caveat: delayed execution after sandbox timeouts is a classic anti-analysis class; do not re-label it as phishing pretext or patch policy merely because those terms appear in municipal contexts.
Operational check for county SOCs: lengthen sandbox runtimes for suspicious municipal samples; instrument delayed network and process activity; preserve timelines showing quiet-then-active transitions; and update detection content for sleep/timer patterns without assuming every quiet sample is benign update behavior.