← Back to ATT&CK index
T1029
Scheduled Transfer
View on attack.mitre.org →4 syscalls implement this technique
- NtSetEvent
Sets an event object to the signaled state, releasing waiting threads.
- NtCreateTimer
Creates a kernel timer object that can be armed later with NtSetTimer.
- NtSetTimer
Arms a timer object with a due time, optional period and an optional APC routine fired on expiry.
- NtSetTimer2
Arms a Timer2 object with a due time, optional period and a T2_SET_PARAMETERS block describing callback and flags.