System time changed

Status: experimental
Severity: medium
Log source: product windows, service security
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker attempts to change the system time to evade defense. Check also if NewTime is different from PreviousTime to reduce false positives.

Known false positives

Hypervisors

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1070.006` Indicator Removal: Timestomp

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4616: The system time was changed.

Rule body

title: System time changed
description: Detects scenarios where an attacker attempts to change the system time to evade defense. Check also if NewTime is different from PreviousTime to reduce false positives.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0005-Defense%20Evasion/T1070.006-Timestomp
- https://blog.menasec.net/2019/02/threat-hunting-19-suspicious-system.html
tags:
- attack.defense_evasion
- attack.t1070.006
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4616
  filter:
    ProcessName|endswith:
      - '\VMware\VMware Tools\vmtoolsd.exe' # triggered by the System account
      - '\Windows\System32\svchost.exe'     # triggered by the Local service account / S-1-5-19
      #- '\Windows\System32\dllhost.exe'    # triggered by the Control Panel GUI, may be suspicious
  condition: selection and not filter
falsepositives:
- Hypervisors
level: medium

Stages and Predicates

Stage 0: `condition`

selection and not filter

Stage 1: `selection`

selection:
  EventID: 4616

Stage 2: `not filter`

filter:
  ProcessName|endswith:
    - '\VMware\VMware Tools\vmtoolsd.exe'
    - '\Windows\System32\svchost.exe'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`ProcessName`	ends_with	`\VMware\VMware Tools\vmtoolsd.exe`	`excludes:ProcessName` `field:"ProcessName" value:"\VMware\VMware Tools\vmtoolsd.exe"`
`ProcessName`	ends_with	`\Windows\System32\svchost.exe`	`excludes:ProcessName` `field:"ProcessName" value:"\Windows\System32\svchost.exe"`