System Time Discovery T1124

Tactic: Discovery

An adversary may gather the system time and/or time zone settings from a local or remote system. The system time is set and stored by services, such as the Windows Time Service on Windows or systemsetup on macOS. These time settings may also be synchronized between systems and services in an enterprise network, typically accomplished with a network time server within a domain.

Events covered

2 catalog events are tagged with this technique by at least one rule.

Authoring guide

These 6 rules share fields, values, and exclusions.

Fields filtered most (9 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
CommandLine4contains 3, regex_match 1 /computer:localhost , /dataonly , /period:, (?i)net.*?time.*?\x5c\x5c, /computer:
Image2ends_with 2\w32tm.exe, \net.exe, \net1.exe
process_name2eq 2net.exe, net1.exe, tzutil.exe, w32tm.exe
EventID1eq 14688
OriginalFileName1eq 1w32time.dll
Type1eq 1
event.type1eq 1start
host.os.type1eq 1
process.args1eq 1/g, /tz, time

Top indicator values (26 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
Imageends_with
\w32tm.exe
22
Imageends_with
\net.exe
149
Imageends_with
\net1.exe
147
process_nameeq
w32tm.exe
23
process_nameeq
net.exe
128
process_nameeq
net1.exe
139
process_nameeq
tzutil.exe
12
CommandLinecontains
/computer:localhost
1
CommandLinecontains
/dataonly
1
CommandLinecontains
/period:
1
CommandLinecontains
/samples:
1
CommandLinecontains
/stripchart
1
CommandLinecontains
/computer:
12
CommandLinecontains
/dataonly
1
CommandLinecontains
/period:
1
CommandLinecontains
/samples:
1
CommandLinecontains
/stripchart
1
CommandLinecontains
time
1
CommandLinecontains
tz
1
CommandLineregex_match
(?i)net.*?time.*?\x5c\x5c
1
EventIDeq
4688
1317
OriginalFileNameeq
w32time.dll
1
event.typeeq
start
11078
process.argseq
/g
1
process.argseq
/tz
1
process.argseq
time
12

Exclusions (3 distinct)

These values appear most often in top-level exclusions.

FieldKindValueRules excluding
user.ideq
s-1-5-18
1
user.ideq
s-1-5-19
1
user.ideq
s-1-5-20
1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform (all)
Domain (all)

Sigma 3 rules

Elastic 1 rule

Splunk 2 rules