Techniques › T1124
T1124 System Time Discovery
discovery — ESXi, Linux, macOS, Network Devices, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
5
analytics
3
Sigma rules tagged attack.t1124
0
KEV CVEs mapped here
<p>An adversary may gather the system time and/or time zone settings from a local or remote system. The system time is set and stored by services, such as the Windows Time Service on Windows or <code>systemsetup</code> on macOS. These time settings may also be synchronized between systems and services in an enterprise network, typically accomplished with a network time server within a domain.</p><p>System time information may be gathered in a number of ways, such as with Net on Windows by performing <code>net time \\hostname</code> to gather the system time on a remote system. The victim's time zone may also be inferred from the current system time or gathered by using <code>w32tm /tz</code>. In addition, adversaries can discover device uptime through functions such as <code>GetTickCount()</code> to determine how long it has been since the system booted up.</p><p>On network devices, Network Device CLI commands such as
show clock detail can be used to see the current time configuration. On ESXi servers, esxcli system clock get can be used for the same purpose.</p><p>In addition, system calls – such as <code>time()</code> – have been used to collect the current time on Linux devices. On macOS systems, adversaries may use commands such as <code>systemsetup -gettimezone</code> or <code>timeIntervalSinceNow</code> to gather current time zone information or current date and time.</p><p>This information could be useful for performing other techniques, such as executing a file with a Scheduled Task/Job, or to discover locality information based on time zone to assist in victim targeting (i.e. System Location Discovery). Adversaries may also use knowledge of system time as part of a time bomb, or delaying execution until a specified date/time.</p>KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0151 Behavior-chain, platform-aware detection strategy for T1124 System Time Discovery v1.0
AN0430 WindowsUntrusted or unusual process/script (cmd.exe, powershell.exe, w32tm.exe, net.exe, custom binaries) queries system time/timezone (e.g., w32tm /tz, net time \\host, Get-TimeZone, GetTickCount API) and (optionally) is followed within a short window by time-based scheduling or conditional execution (e.g., schtasks /create, at.exe, PowerShell Start-Sleep with large values).etw:Microsoft-Windows-Kernel-Process
High-frequency or suspicious sequence of QueryPerformanceCounter/GetTickCount API calls from a non-standard process lineage→ DC0021 OS API ExecutionWinEventLog:TaskSchedulerTask registration/execution shortly after a time discovery event→ DC0005 Scheduled Job MetadataEDR:TelemetryProcess lineage and API usage enrichment (GetSystemTime, GetTimeZoneInformation, NtQuerySystemTime)→ DC0034 Process MetadataTunable:TimeWindowAllowedParentsCommandlineKeywordListUserContextScopeProcessPrevalenceThresholdAN0431 LinuxA process (often spawned by a shell, interpreter, or malware implant) executes time discovery via commands (date, timedatectl, hwclock, cat /etc/timezone, /proc/uptime) or direct syscalls (time(), clock_gettime) and is (optionally) followed by scheduled task creation/modification (crontab, at) or conditional sleep logic.auditd:SYSCALLtype=EXECVE or SYSCALL for /bin/date, /usr/bin/timedatectl, /sbin/hwclock, /bin/cat /etc/timezone, /bin/cat /proc/uptime→ DC0032 Process Creationauditd:SYSCALLRules capturing clock_gettime, time, gettimeofday syscalls when enabled→ DC0021 OS API Executionlinux:syslogsudo/date/timedatectl execution by non-standard users→ DC0002 User Account AuthenticationTunable:AuditRulesSyscallsAllowedBinariesTimeWindowUserContextScopeAN0432 macOSProcess/script execution of systemsetup -gettimezone, date, ioreg, or API usage (timeIntervalSinceNow, gettimeofday) followed by time-based scheduling (launchd plist modification) or sleep-based execution.macos:unifiedlogprocess exec events of systemsetup, date, ioreg with command_line parameters indicating time discovery→ DC0032 Process Creationmacos:unifiedlogNew/modified launchd plist (persistence/scheduling) within TimeWindow after time query→ DC0005 Scheduled Job MetadataTunable:LaunchdPathsTimeWindowAllowedCallersAN0433 ESXiInteractive or remote shell/API invocation of esxcli system clock get or querying time parameters via hostd/vpxa shortly followed by time/ntp configuration checks or scheduled task creation, executed by non-standard accounts or outside maintenance windows.esxi:shell/var/log/shell.log entries containing "esxcli system clock get"→ DC0064 Command Executionesxi:hostd/var/log/hostd.log API calls reading/altering time/ntp settings→ DC0034 Process Metadataesxi:syslog/var/log/vpxa.log task invocations tied to time configuration→ DC0005 Scheduled Job MetadataTunable:MaintenanceWindowPrivilegedAccountsAllowListRemoteIPAllowListTimeWindowAN0434 Network DevicesNon-standard or rare users/locations issue CLI commands like "show clock detail" or "show timezone"; optionally followed by configuration of time/timezone or NTP sources. AAA/TACACS+ accounting and syslog correlate execution to identity, source IP, and privilege level.networkdevice:syslogcommand-exec: CLI commands containing "show clock", "show clock detail", "show timezone" executed by suspicious user/source→ DC0064 Command Executionnetworkdevice:configconfig-change: timezone or ntp server configuration change after a time query command→ DC0061 File ModificationTunable:AllowedAdminSubnetsKnownMaintenanceUsersTimeWindow
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1124
Author: frack113
· 2022-09-25 · logsource: product=windows category=process_creation · 6da2c9f5-7c53-401b-aacb-92c040ce1215
When configured with suitable command line arguments, w32tm can act as a delay mechanism
Author: Austin Clark
· 2019-08-12 (modified 2023-01-04) · logsource: product=cisco service=aaa · 9705a6a1-6db6-4a16-a987-15b7151e299b
Find information about network devices that is not stored in config files
Author: E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community
· 2019-10-24 (modified 2022-06-28) · logsource: product=windows category=process_creation · b243b280-65fe-48df-ba07-6ddea7646427
Identifies use of various commands to query a systems time. This technique may be used before executing a scheduled task or to discover the time zone of a target system.