What is Logic Bomb?

NIST defines a logic bomb as a piece of code intentionally inserted into a software system that sets off a malicious function when specified conditions are met. There are two parts, the trigger and the payload. Triggers come in a few shapes:

• time-based ones that run on a date (often called time bombs),
• event-based ones that run when something happens, such as the author's account disappearing from the directory,
• and dead man's switch designs that run unless someone keeps resetting a check.

The payload is usually destructive, because the author wants damage or leverage, not access.

What sets logic bombs apart from most malware is who plants them. The typical author is an administrator, developer or contractor who already has write access to production scripts, database jobs or source code, and who plants the bomb as revenge after a dispute or as insurance against being let go. Because the code sits inside something the organization already trusts, it passes antivirus and often change control without raising anything. It does not beacon, does not spread and does nothing at all until the trigger fires.

In ATT&CK terms the payload of most logic bombs lands in the Impact tactic, usually Data Destruction (T1485), and the trigger often rides on Scheduled Task/Job (T1053): a cron entry or a Windows scheduled task that calls a script on a certain date or checks a condition every night. That is also where detection has a chance. A scheduled job whose only purpose is to call a destructive command, or a script that tests whether one particular username still exists, is unusual enough to stand out in a review, provided someone reviews the jobs a person created before that person leaves.