Find sigma rule
Attack: System Time Discovery
An adversary may gather the system time and/or time zone settings from a local or remote system. The system time is set and stored by services, such as the Windows Time Service on Windows or systemsetup
on macOS.(Citation: MSDN System Time)(Citation: Technet Windows Time Service)(Citation: systemsetup mac time) These time settings may also be synchronized between systems and services in an enterprise network, typically accomplished with a network time server within a domain.(Citation: Mac Time Sync)(Citation: linux system time)
System time information may be gathered in a number of ways, such as with Net on Windows by performing net time \\hostname
to gather the system time on a remote system. The victim’s time zone may also be inferred from the current system time or gathered by using w32tm /tz
.(Citation: Technet Windows Time Service) In addition, adversaries can discover device uptime through functions such as GetTickCount()
to determine how long it has been since the system booted up.(Citation: Virtualization/Sandbox Evasion)
On network devices, Network Device CLI commands such as show clock detail
can be used to see the current time configuration.(Citation: show_clock_detail_cisco_cmd)
In addition, system calls – such as time()
– have been used to collect the current time on Linux devices.(Citation: MAGNET GOBLIN) On macOS systems, adversaries may use commands such as systemsetup -gettimezone
or timeIntervalSinceNow
to gather current time zone information or current date and time.(Citation: System Information Discovery Technique)(Citation: ESET DazzleSpy Jan 2022)
This information could be useful for performing other techniques, such as executing a file with a Scheduled Task/Job(Citation: RSA EU12 They’re Inside), or to discover locality information based on time zone to assist in victim targeting (i.e. System Location Discovery). Adversaries may also use knowledge of system time as part of a time bomb, or delaying execution until a specified date/time.(Citation: AnyRun TimeBomb)
MITRE
Tactic
- discovery
technique
- T1124
Test : System Time Discovery - PowerShell
OS
- windows
Description:
Identify the system time via PowerShell. Upon execution, the system time will be displayed.
Executor
powershell
Sigma Rule
- proc_creation_win_remote_time_discovery.yml (id: b243b280-65fe-48df-ba07-6ddea7646427)