System time changed (PowerShell)

title: System time changed (PowerShell)
description: Detects scenarios where an attacker attempts to change the system time to evade defense.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0005-Defense%20Evasion/T1070.006-Timestomp
- https://blog.menasec.net/2019/02/threat-hunting-19-suspicious-system.html
- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/set-date
tags:
- attack.defense_evasion
- attack.t1070.006
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category:
    - ps_module
    - ps_classic_script
    - ps_script
detection: # full command: Set-Date -Date (Get-Date).AddDays(3)
  selection_powershell_native:
    EventID: 800
    EventData|contains: Set-Date
    EventData|contains:
      - -Date
      - -Adjust

  selection_powershell_modern:
    EventID: 4103
    Payload|contains: Set-Date
    Payload|contains:
      - -Date
      - -Adjust

  selection_powershell_block:
    EventID: 4104
    ScriptBlockText|contains: Set-Date
    ScriptBlockText|contains:
      - -Date
      - -Adjust

  condition: selection_powershell_native or selection_powershell_modern or selection_powershell_block
falsepositives:
- None
level: medium