Use of W32tm as Timer

Title: Use of W32tm as Timer
Status: test
Description:When configured with suitable command line arguments, w32tm can act as a delay mechanism
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/d0dad62dbcae9c60c519368e82c196a3db577055/atomics/T1124/T1124.md
  -https://blogs.blackberry.com/en/2022/05/dirty-deeds-done-dirt-cheap-russian-rat-offers-backdoor-bargains
Author: frack113
Date: 2022-09-25
modified:None
Tags:

• -'attack.discovery'
• -'attack.t1124'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_w32tm:
Image|endswith:'\w32tm.exe' OriginalFileName:'w32time.dll'   selection_cmd:
    CommandLine|contains|all:
      -'/stripchart'
      -'/computer:'
      -'/period:'
      -'/dataonly'
      -'/samples:'

  condition:all of selection_*
Falsepositives:
  -Legitimate use
Level: high