Discovery of a System Time

Title: Discovery of a System Time
Status: test
Description:Identifies use of various commands to query a systems time. This technique may be used before executing a scheduled task or to discover the time zone of a target system.
References:
  -https://eqllib.readthedocs.io/en/latest/analytics/fcdb99c2-ac3c-4bde-b664-4b336329bed2.html
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1124/T1124.md
Author: E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community
Date: 2019-10-24
modified:2022-06-28
Tags:

• -'attack.discovery'
• -'attack.t1124'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_time:
    Image|endswith:
      -'\net.exe'
      -'\net1.exe'

    CommandLine|contains: 'time'
  selection_w32tm:
    Image|endswith: '\w32tm.exe'
    CommandLine|contains: 'tz'
  condition:1 of selection_*
Falsepositives:
  -Legitimate use of the system utilities to discover system time for legitimate reason
Level: low