{"id":"b243b280-65fe-48df-ba07-6ddea7646427","title":"Discovery of a System Time","description":"Identifies use of various commands to query a systems time. This technique may be used before executing a scheduled task or to discover the time zone of a target system.","author":"E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community","status":"test","level":"low","date":"2019-10-24","modified":"2022-06-28","tags":["attack.discovery","attack.t1124"],"technique_ids":["T1124"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Legitimate use of the system utilities to discover system time for legitimate reason"],"references":["https://eqllib.readthedocs.io/en/latest/analytics/fcdb99c2-ac3c-4bde-b664-4b336329bed2.html","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1124/T1124.md"],"source_path":"rules/windows/process_creation/proc_creation_win_remote_time_discovery.yml","source_sha256":"19b7e7b02bea54e191bd756f846070af6359eca260eb1edf17214693b4509085","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_remote_time_discovery.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Discovery of a System Time\nid: b243b280-65fe-48df-ba07-6ddea7646427\nstatus: test\ndescription: Identifies use of various commands to query a systems time. This technique may be used before executing a scheduled task or to discover the time zone of a target system.\nreferences:\n    - https://eqllib.readthedocs.io/en/latest/analytics/fcdb99c2-ac3c-4bde-b664-4b336329bed2.html\n    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1124/T1124.md\nauthor: E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community\ndate: 2019-10-24\nmodified: 2022-06-28\ntags:\n    - attack.discovery\n    - attack.t1124\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_time:\n        Image|endswith:\n            - '\\net.exe'\n            - '\\net1.exe'\n        CommandLine|contains: 'time'\n    selection_w32tm:\n        Image|endswith: '\\w32tm.exe'\n        CommandLine|contains: 'tz'\n    condition: 1 of selection_*\nfalsepositives:\n    - Legitimate use of the system utilities to discover system time for legitimate reason\nlevel: low\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1124","id":"T1124","name":"System Time Discovery","page":"techniques/enterprise/T1124/"}],"data_path":"data/detection-rules/b243b280-65fe-48df-ba07-6ddea7646427.json","kind":"sigma"}