New TimeProviders Registered With Uncommon DLL Name
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects processes setting a new DLL in DllName in under HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\W32Time\\TimeProvider. Adversaries may abuse time providers to execute DLLs when the system boots. The Windows Time service (W32Time) enables time synchronization across and within domains.
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "Registry value modified" AND ((OBJECTNAME contains "\Services\W32Time\TimeProviders" OR (OBJECTNAME endswith "\Services\W32Time" AND OBJECTVALUENAME startswith "TimeProviders")) AND OBJECTNAME endswith "\DllName") AND INFORMATION != "%SystemRoot%\System32\vmictimeprovider.dll,%systemroot%\system32\w32time.dll,C:\Windows\SYSTEM32\w32time.DLL" select Action1.HOSTNAME,Action1.MESSAGE,Action1.OBJECTNAME,Action1.PROCESSNAME,Action1.PREVVAL,Action1.CHANGES
Detection
Execution Mode
realtime
Log Sources
Windows
Author
frack113
