Cross-source coverage

T1124 / ATT&CK

System Time Discovery

12 rules across 4 sources.

Showing deprecated rules · back to the default

From MITRE ATT&CK 19.2

An adversary may gather the system time and/or time zone settings from a local or remote system. The system time is set and stored by services, such as the Windows Time Service on Windows or systemsetup on macOS. These time settings may also be synchronized between systems and services in an enterprise network, typically accomplished with a network time server within a domain.

System time information may be gathered in a number of ways, such as with Net on Windows by performing net time \\hostname to gather the system time on a remote system. The victim's time zone may also be inferred from the current system time or gathered by using w32tm /tz. In addition, adversaries can discover device uptime through functions such as GetTickCount() to determine how long it has been since the system booted up.

On network devices, Network Device CLI commands such as show clock detail can be used to see the current time configuration. On ESXi servers, esxcli system clock get can be used for the same purpose.

In addition, system calls – such as time() – have been used to collect the current time on Linux devices. On macOS systems, adversaries may use commands such as systemsetup -gettimezone or timeIntervalSinceNow to gather current time zone information or current date and time.

This information could be useful for performing other techniques, such as executing a file with a Scheduled Task/Job, or to discover locality information based on time zone to assist in victim targeting (i.e. System Location Discovery). Adversaries may also use knowledge of system time as part of a time bomb, or delaying execution until a specified date/time.

Tactics
Discovery
Platforms
ESXi · Linux · macOS · Network Devices · Windows
Telemetry
WinEventLog:SecurityWinEventLog:SysmonWinEventLog:PowerShelletw:Microsoft-Windows-Kernel-ProcessWinEventLog:TaskSchedulerEDR:Telemetryauditd:SYSCALLlinux:sysloglinux:cronmacos:unifiedlogesxi:shellesxi:hostdesxi:syslognetworkdevice:syslognetworkdevice:config

How MITRE says to detect it DET0151

Behavior-chain, platform-aware detection strategy for T1124 System Time Discovery

Windows Analytic 0430

Untrusted or unusual process/script (cmd.exe, powershell.exe, w32tm.exe, net.exe, custom binaries) queries system time/timezone (e.g., w32tm /tz, net time \\host, Get-TimeZone, GetTickCount API) and (optionally) is followed within a short window by time-based scheduling or conditional execution (e.g., schtasks /create, at.exe, PowerShell Start-Sleep with large values).

  • WinEventLog:Security EventCode=4688
  • WinEventLog:Sysmon EventCode=7
  • WinEventLog:Sysmon EventCode=10
  • WinEventLog:Sysmon EventCode=11
  • WinEventLog:PowerShell EventCode=4103, 4104, 4105, 4106
  • etw:Microsoft-Windows-Kernel-Process High-frequency or suspicious sequence of QueryPerformanceCounter/GetTickCount API calls from a non-standard process lineage
  • WinEventLog:TaskScheduler EventCode=106
  • WinEventLog:TaskScheduler Task registration/execution shortly after a time discovery event
  • EDR:Telemetry Process lineage and API usage enrichment (GetSystemTime, GetTimeZoneInformation, NtQuerySystemTime)

Linux Analytic 0431

A process (often spawned by a shell, interpreter, or malware implant) executes time discovery via commands (date, timedatectl, hwclock, cat /etc/timezone, /proc/uptime) or direct syscalls (time(), clock_gettime) and is (optionally) followed by scheduled task creation/modification (crontab, at) or conditional sleep logic.

  • auditd:SYSCALL type=EXECVE or SYSCALL for /bin/date, /usr/bin/timedatectl, /sbin/hwclock, /bin/cat /etc/timezone, /bin/cat /proc/uptime
  • auditd:SYSCALL Rules capturing clock_gettime, time, gettimeofday syscalls when enabled
  • linux:syslog sudo/date/timedatectl execution by non-standard users
  • linux:cron cron activity

macOS Analytic 0432

Process/script execution of systemsetup -gettimezone, date, ioreg, or API usage (timeIntervalSinceNow, gettimeofday) followed by time-based scheduling (launchd plist modification) or sleep-based execution.

  • macos:unifiedlog process exec events of systemsetup, date, ioreg with command_line parameters indicating time discovery
  • macos:unifiedlog New/modified launchd plist (persistence/scheduling) within TimeWindow after time query

ESXi Analytic 0433

Interactive or remote shell/API invocation of esxcli system clock get or querying time parameters via hostd/vpxa shortly followed by time/ntp configuration checks or scheduled task creation, executed by non-standard accounts or outside maintenance windows.

  • esxi:shell /var/log/shell.log entries containing "esxcli system clock get"
  • esxi:hostd /var/log/hostd.log API calls reading/altering time/ntp settings
  • esxi:syslog /var/log/vpxa.log task invocations tied to time configuration

Network Devices Analytic 0434

Non-standard or rare users/locations issue CLI commands like "show clock detail" or "show timezone"; optionally followed by configuration of time/timezone or NTP sources. AAA/TACACS+ accounting and syslog correlate execution to identity, source IP, and privilege level.

  • networkdevice:syslog command-exec: CLI commands containing "show clock", "show clock detail", "show timezone" executed by suspicious user/source
  • networkdevice:config config-change: timezone or ntp server configuration change after a time query command

View on attack.mitre.org ↗

socfortress/Wazuh-Rules

7 rules
Detection Severity Format
Sysmon - Event 1: Process creation · w32tm delay tactic (T1124) High Wazuh XML
Sysmon - Event 1: Process creation · Get-Date PowerShell system time (T1124) Medium Wazuh XML
Sysmon - Event 1: Process creation · net time discovery (T1124) Medium Wazuh XML
Sysmon - Event 1: Process creation · Registry TimeZone Discovery (T1124) Medium Wazuh XML
Sysmon - Event 1: Process creation · w32tm timezone discovery (T1124) Medium Wazuh XML
Sysmon - Event 1: Process creation · Windows time command execution (T1124) Medium Wazuh XML
System time discovery using the 'date' command (T1124) Medium Wazuh XML

SigmaHQ/sigma

3 rules
Detection Severity Format
Use of W32tm as Timer High Sigma
Cisco Discovery Low Sigma
Discovery of a System Time Low Sigma

chronicle/detection-rules

1 rule
Detection Severity Format
possible_system_time_discovery_sysmonwindows_logs Undefined YARA-L

splunk/security_content

1 rule
Detection Severity Format
Windows System Time Discovery W32tm Delay Undefined SPL

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.