detection.wiki

Detection rules › Sigma

Unauthorized System Time Modification

Status
test
Severity
low
Log source
product windows, service security
Author
@neu5ron
Source
github.com/SigmaHQ/sigma

Detect scenarios where a potentially unauthorized application or user is modifying the system time.

Known false positives

  • HyperV or other virtualization technologies with binary not listed in filter portion of detection

MITRE ATT&CK coverage

TacticTechniques
Stealth

Telemetry coverage

ProviderRecord / event type
Security-AuditingEvent ID 4616: The system time was changed.

Rule body

title: Unauthorized System Time Modification
id: faa031b5-21ed-4e02-8881-2591f98d82ed
status: test
description: Detect scenarios where a potentially unauthorized application or user is modifying the system time.
references:
    - Private Cuckoo Sandbox (from many years ago, no longer have hash, NDA as well)
    - Live environment caused by malware
    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4616
author: '@neu5ron'
date: 2019-02-05
modified: 2025-12-03
tags:
    - attack.stealth
    - attack.t1070.006
logsource:
    product: windows
    service: security
    definition: 'Requirements: Audit Policy : System > Audit Security State Change, Group Policy : Computer Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\System\Audit Security State Change'
detection:
    selection:
        EventID: 4616
    filter_main_svchost:
        ProcessName: 'C:\Windows\System32\svchost.exe'
        SubjectUserSid: 'S-1-5-19'
    filter_optional_vmtools:
        ProcessName:
            - 'C:\Program Files\VMware\VMware Tools\vmtoolsd.exe'
            - 'C:\Program Files (x86)\VMware\VMware Tools\vmtoolsd.exe'
            - 'C:\Windows\System32\VBoxService.exe'
            - 'C:\Windows\System32\oobe\msoobe.exe'
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - HyperV or other virtualization technologies with binary not listed in filter portion of detection
level: low

Stages and Predicates

Stage 0: condition

selection and not 1 of filter_main_* and not 1 of filter_optional_*

Stage 1: selection

selection:
    EventID: 4616

Stage 2: not filter_main_svchost

filter_main_svchost:
    ProcessName: 'C:\Windows\System32\svchost.exe'
    SubjectUserSid: 'S-1-5-19'

Stage 3: not filter_optional_vmtools

filter_optional_vmtools:
    ProcessName:
        - 'C:\Program Files\VMware\VMware Tools\vmtoolsd.exe'
        - 'C:\Program Files (x86)\VMware\VMware Tools\vmtoolsd.exe'
        - 'C:\Windows\System32\VBoxService.exe'
        - 'C:\Windows\System32\oobe\msoobe.exe'

Exclusions

The rule actively suppresses these predicates.

FieldKindExcluded valuesSearch
ProcessNameeqC:\Windows\System32\svchost.exeexcludes:ProcessName field:"ProcessName" value:"C:\Windows\System32\svchost.exe"
SubjectUserSideqS-1-5-19excludes:SubjectUserSid field:"SubjectUserSid" value:"S-1-5-19"
ProcessNameeqC:\Program Files (x86)\VMware\VMware Tools\vmtoolsd.exeexcludes:ProcessName field:"ProcessName" value:"C:\Program Files (x86)\VMware\VMware Tools\vmtoolsd.exe"
ProcessNameeqC:\Program Files\VMware\VMware Tools\vmtoolsd.exeexcludes:ProcessName field:"ProcessName" value:"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe"
ProcessNameeqC:\Windows\System32\VBoxService.exeexcludes:ProcessName field:"ProcessName" value:"C:\Windows\System32\VBoxService.exe"
ProcessNameeqC:\Windows\System32\oobe\msoobe.exeexcludes:ProcessName field:"ProcessName" value:"C:\Windows\System32\oobe\msoobe.exe"