Find sigma rule 
Attack: Time Providers
Adversaries may abuse time providers to execute DLLs when the system boots. The Windows Time service (W32Time) enables time synchronization across and within domains.(Citation: Microsoft W32Time Feb 2018) W32Time time providers are responsible for retrieving time stamps from hardware/network resources and outputting these values to other network clients.(Citation: Microsoft TimeProvider)
Time providers are implemented as dynamic-link libraries (DLLs) that are registered in the subkeys of HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\W32Time\TimeProviders\.(Citation: Microsoft TimeProvider) The time provider manager, directed by the service control manager, loads and starts time providers listed and enabled under this key at system startup and/or whenever parameters are changed.(Citation: Microsoft TimeProvider)
Adversaries may abuse this architecture to establish persistence, specifically by creating a new arbitrarily named subkey pointing to a malicious DLL in the DllName value. Administrator privileges are required for time provider registration, though execution will run in context of the Local Service account.(Citation: Github W32Time Oct 2017)
MITRE
Tactic
- persistence
- privilege-escalation
technique
- T1547.003
Test : Edit an existing time provider
OS
- windows
Description:
Establishes persistence by editing the NtpServer time provider registry key under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProvider. The time provider will point to a DLL which will be loaded after the w32time service is started. The DLL will then create the file AtomicTest.txt in C:\Users\Public\ as validation that the test is successful.
Payload source code: https://github.com/tr4cefl0w/payloads/tree/master/T1547.003/
Executor
powershell
Sigma Rule
-
proc_creation_win_remote_time_discovery.yml (id: b243b280-65fe-48df-ba07-6ddea7646427)
-
proc_creation_win_net_execution.yml (id: 183e7ea8-ac4b-4c23-9aec-b3dac4e401ac)
-
file_event_win_shell_write_susp_directory.yml (id: 1277f594-a7d1-4f28-a2d3-73af5cbeab43)
-
registry_set_timeproviders_dllname.yml (id: e88a6ddc-74f7-463b-9b26-f69fc0d2ce85)
-
proc_creation_win_net_start_service.yml (id: 2a072a96-a086-49fa-bcb5-15cc5a619093)
-
image_load_susp_dll_load_system_process.yml (id: 9e9a9002-56c4-40fd-9eff-e4b09bfa5f6c)