Procedure examples

Kimsuky has gathered the system time of the device using the PowerShell cmdlet `Get-Date`.

Volt Typhoon has obtained the victim's system timezone.

FIN7 has used the PowerShell script 3CF9.ps1 to execute `net time`.

CURIUM deployed mechanisms to check system time information following strategic website compromise attacks.

Sidewinder has used tools to obtain the current system time.

ZIRCONIUM has used a tool to capture the time on a compromised host in order to register it with C2.

UNC3886 has used installation scripts to collect the system time on targeted ESXi hosts.

Higaisa used a function to gather the current time.

The White Company has checked the current date on the victim system.

Turla surveys a system upon check-in to discover the system time by using the net time command.

Chimera has used time /t and net time \\ip/hostname for system time discovery.

BRONZE BUTLER has used net time to check the local time on a target system.

Darkhotel malware can obtain system time from a compromised host.

A Destover-like implant used by Lazarus Group can obtain the current system time and send it to the C2 server.