Techniques › T1124 › AN0431
AN0431 Analytic 0431
Linux · attack.mitre.org · ATT&CK Enterprise v19.2
<p>A process (often spawned by a shell, interpreter, or malware implant) executes time discovery via commands (date, timedatectl, hwclock, cat /etc/timezone, /proc/uptime) or direct syscalls (time(), clock_gettime) and is (optionally) followed by scheduled task creation/modification (crontab, at) or conditional sleep logic.</p>
- Detects
- T1124 System Time Discovery
- Part of
- DET0151 Behavior-chain, platform-aware detection strategy for T1124 System Time Discovery
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| auditd:SYSCALL | type=EXECVE or SYSCALL for /bin/date, /usr/bin/timedatectl, /sbin/hwclock, /bin/cat /etc/timezone, /bin/cat /proc/uptime | DC0032 Process Creation |
| auditd:SYSCALL | Rules capturing clock_gettime, time, gettimeofday syscalls when enabled | DC0021 OS API Execution |
| linux:syslog | sudo/date/timedatectl execution by non-standard users | DC0002 User Account Authentication |
| linux:cron | cron activity | DC0005 Scheduled Job Metadata |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
AuditRulesSyscalls | Scope of syscalls (time, clock_gettime, gettimeofday) monitored; may be performance-sensitive. |
AllowedBinaries | List of legitimate automation/orchestration tools frequently querying time. |
TimeWindow | Correlation window (e.g., 5–20 minutes) to link time discovery to follow-on cron/at changes. |
UserContextScope | Ignore root-owned maintenance agents if desired; focus on interactive or newly created users. |