System time discovery identified
Last updated on:
In this page
Rule name | Rule type | Log sources | MITRE ATT&CK tags | Severity |
|---|---|---|---|---|
System time discovery identified | Standard | Windows, Sysmon | Discovery: System Time Discovery (T1124) | Attention |
About the rule
Rule Type
Standard
Rule Description
Adversaries may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Why this rule?
Adversaries query system time to coordinate actions, evade detection by timing their activities, or establish synchronization for distributed attacks. This reconnaissance technique helps attackers understand the victim environment and can indicate early-stage attack preparation. Monitoring time discovery attempts provides visibility into potential adversary reconnaissance activities.
Severity
Attention
Rule journey
Attack chain scenario
Initial Access → Execution → Discovery → System Time Discovery → Coordination of time-sensitive malicious tasks or lateral movement.
Impact
- Adversaries use time information to plan scheduled tasks.
- Synchronization of attacks across multiple systems in the network.
- Evasion of time-based security controls.
Rule Requirement
Prerequisites
Enable Process Creation auditing (Event ID 4688) or Sysmon Event ID 1. Ensure command-line logging is enabled to capture arguments like "time".
Criteria
Action1:
actionname = "Process started" AND (( PROCESSNAME endswith "net.exe,net1.exe" OR ORIGINALFILENAME = "net.exe,net1.exe" ) AND ( COMMANDLINE contains "time" AND COMMANDLINE notcontains "/set" ) OR ( PROCESSNAME contains "w32tm.exe" AND COMMANDLINE contains "/tz" ) OR ( PROCESSNAME endswith "powershell.exe,pwsh.exe" AND COMMANDLINE contains "Get-Date" ) OR ( PROCESSNAME endswith "tzutil.exe" AND COMMANDLINE contains "/g" ))
select Action1.HOSTNAME,Action1.MESSAGE,Action1.COMMANDLINE,Action1.FILE_NAME,Action1.PROCESSNAME,Action1.USERNAME,Action1.PARENTPROCESSNAME,Action1.DOMAIN,Action1.ORIGINALFILENAME,Action1.PARENTPROCESSID,Action1.PROCESSID,Action1.PRODUCT_NAME,Action1.SECURITYID
Detection
Execution Mode
realtime
Log Sources
Windows
MITRE ATT&CK
Discovery: System Time Discovery (T1124)
Future actions
Known False Positives
Administrative troubleshooting scripts, legitimate time synchronization monitoring, or automated system maintenance tasks that check local time.
Next Steps
- Identification: Identify the user and process that executed the time discovery command.
- Analysis: Check if the command was executed on a local system or directed toward a remote domain controller.
- Response: If the activity is part of an unapproved script, investigate the source process for further discovery commands.
