detection.wiki

Detection rules › Sigma

System time changed

Status
experimental
Severity
medium
Log source
product windows, service security
Author
mdecrevoisier
Source
github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker attempts to change the system time to evade defense. Check also if NewTime is different from PreviousTime to reduce false positives.

MITRE ATT&CK coverage

TacticTechniques
StealthT1070.006 Indicator Removal: Timestomp

Event coverage

ProviderEventTitle
Security-AuditingEvent ID 4616The system time was changed.

Rule body yaml

title: System time changed
description: Detects scenarios where an attacker attempts to change the system time to evade defense. Check also if NewTime is different from PreviousTime to reduce false positives.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0005-Defense%20Evasion/T1070.006-Timestomp
- https://blog.menasec.net/2019/02/threat-hunting-19-suspicious-system.html
tags:
- attack.defense_evasion
- attack.t1070.006
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4616
  filter:
    ProcessName|endswith:
      - '\VMware\VMware Tools\vmtoolsd.exe' # triggered by the System account
      - '\Windows\System32\svchost.exe'     # triggered by the Local service account / S-1-5-19
      #- '\Windows\System32\dllhost.exe'    # triggered by the Control Panel GUI, may be suspicious
  condition: selection and not filter
falsepositives:
- Hypervisors
level: medium

Stages and Predicates

Stage 0: condition

selection and not filter

Stage 1: selection

selection:
  EventID: 4616

Stage 2: not filter

filter:
  ProcessName|endswith:
    - '\VMware\VMware Tools\vmtoolsd.exe'
    - '\Windows\System32\svchost.exe'

Exclusions

Top-level NOT(...) conjuncts: predicates this rule actively suppresses.

FieldKindExcluded values
ProcessNameends_with\VMware\VMware Tools\vmtoolsd.exe
ProcessNameends_with\Windows\System32\svchost.exe