AN1048: Analytic 1048
Correlated use of sleep/delay mechanisms (e.g., kernel32!Sleep, NTDLL APIs) in short-lived processes, combined with parent processes invoking suspicious scripts (e.g., wscript, powershell) with minimal user interaction.
Analyst context for executives and security teams
This analytic matters because delayed execution can make suspicious Windows activity harder for SOC teams to see in a single event. The supplied ATT&CK description focuses on short-lived processes using sleep or delay APIs, especially when launched by script-capable parents such as wscript or PowerShell with little user interaction. For leaders, the decision value is whether endpoint and process telemetry is rich enough to correlate parent script execution, process lifetime, and delay behavior rather than relying only on obvious command-line indicators.
Executive priority
Prioritize this as a validation item for Windows endpoint detection and incident response readiness. It is most relevant to organizations that depend on script controls, EDR process telemetry, and SOC correlation logic to investigate suspicious execution. Executives should ask whether teams can prove visibility into parent-child process chains, script-host activity, short-lived processes, and API-level delay behavior, and whether that evidence is retained long enough to support incident decisions and audit/compliance narratives.
Technical view
For SOC and detection engineering, validate whether Windows telemetry can correlate three elements from the ATT&CK analytic: short-lived child processes, use of sleep/delay mechanisms such as kernel32!Sleep or NTDLL APIs, and suspicious parent script execution such as wscript or powershell with minimal user interaction. Because ATT&CK does not provide a detection implementation or tactic mapping for this analytic, treat it as a coverage design pattern rather than a ready rule. IR teams should confirm that process lineage, command-line context, script-host activity, timestamps, and any available API/behavioral telemetry can be reconstructed during an investigation.
Likely telemetry
- Windows process creation and termination events, including process lifetime
- Parent-child process lineage for script hosts and spawned processes
- Command-line and script execution context for wscript and powershell where collected
- Endpoint behavioral telemetry showing sleep or delay API usage, where available
- User interaction context or session context, where available
Detection direction
- Test correlation logic against benign administrative scripts and automation to understand false positives from legitimate delays and scheduled/scripted activity.
- Validate that short-lived processes are not missed because of collection latency, sampling, event loss, or retention limits.
- Correlate parent script invocation with child process behavior instead of alerting on sleep/delay behavior alone, since delay mechanisms can be legitimate.
- Tune around local baselines for PowerShell, wscript, automation frameworks, and software installers.
- Document blind spots where API-level telemetry for kernel32!Sleep or NTDLL delay behavior is unavailable; compensate with process lineage and timing analysis where possible.
Mitigation priorities
- First, ensure Windows endpoint logging and EDR policy capture process lineage, command-line context, and script-host activity.
- Next, review controls governing script execution and administrative automation so legitimate use is understood and suspicious parent-child chains are easier to triage.
- Then, build or tune correlation analytics that combine script parent context, short process duration, and delay behavior rather than relying on any one signal.
- Finally, include this behavior in incident response evidence checklists so responders know whether telemetry gaps limit conclusions.
Analyst notes and limits
The supplied ATT&CK object is a detection analytic for Windows only. It provides a behavioral description but no official detection text, no tactic mapping, and no relationship context. The strongest use is as a defensive validation scenario for endpoint telemetry and correlation quality, not as a standalone risk statement.
This take is limited to the official fields supplied. It does not establish attacker attribution, active exploitation, business impact, affected products beyond Windows, or guaranteed detection coverage. Local logging architecture, EDR capabilities, script usage patterns, and retention settings are required to determine practical coverage.
Analytic 1048
Correlated use of sleep/delay mechanisms (e.g., kernel32!Sleep, NTDLL APIs) in short-lived processes, combined with parent processes invoking suspicious scripts (e.g., wscript, powershell) with minimal user interaction.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
All related ATT&CK context
No relationships are available in the current normalized data for this object.
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.0 | Current bundle | 4fea99b82bbd… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
mitre-attack AN1048Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.