{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1124","id":"T1124","name":"System Time Discovery","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1124","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"fbb79b54a4bd55f28c73ae52ef0516333087740ea644efabf91c8d1ae9f7c65a","description":"An adversary may gather the system time and/or time zone settings from a local or remote system. The system time is set and stored by services, such as the Windows Time Service on Windows or <code>systemsetup</code> on macOS.(Citation: MSDN System Time)(Citation: Technet Windows Time Service)(Citation: systemsetup mac time) These time settings may also be synchronized between systems and services in an enterprise network, typically accomplished with a network time server within a domain.(Citation: Mac Time Sync)(Citation: linux system time)\n\nSystem time information may be gathered in a number of ways, such as with [Net](https://attack.mitre.org/software/S0039) on Windows by performing <code>net time \\\\hostname</code> to gather the system time on a remote system. The victim's time zone may also be inferred from the current system time or gathered by using <code>w32tm /tz</code>.(Citation: Technet Windows Time Service) In addition, adversaries can discover device uptime through functions such as <code>GetTickCount()</code> to determine how long it has been since the system booted up.(Citation: Virtualization/Sandbox Evasion)\n\nOn network devices, [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `show clock detail` can be used to see the current time configuration.(Citation: show_clock_detail_cisco_cmd) On ESXi servers, `esxcli system clock get` can be used for the same purpose.\n\nIn addition, system calls – such as <code>time()</code> – have been used to collect the current time on Linux devices.(Citation: MAGNET GOBLIN) On macOS systems, adversaries may use commands such as <code>systemsetup -gettimezone</code> or <code>timeIntervalSinceNow</code> to gather current time zone information or current date and time.(Citation: System Information Discovery Technique)(Citation: ESET DazzleSpy Jan 2022)\n\nThis information could be useful for performing other techniques, such as executing a file with a [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053)(Citation: RSA EU12 They're Inside), or to discover locality information based on time zone to assist in victim targeting (i.e. [System Location Discovery](https://attack.mitre.org/techniques/T1614)). Adversaries may also use knowledge of system time as part of a time bomb, or delaying execution until a specified date/time.(Citation: AnyRun TimeBomb)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1124","external_id":"T1124"},{"source_name":"systemsetup mac time","description":"Apple Support. (n.d.). About systemsetup in Remote Desktop. Retrieved March 27, 2024.","url":"https://support.apple.com/en-gb/guide/remote-desktop/apd95406b8d/mac"},{"source_name":"linux system time","description":"ArchLinux. (2024, February 1). System Time. Retrieved March 27, 2024.","url":"https://wiki.archlinux.org/title/System_time"},{"source_name":"MAGNET GOBLIN","description":"Check Point Research. (2024, March 8). MAGNET GOBLIN TARGETS PUBLICLY FACING SERVERS USING 1-DAY VULNERABILITIES. Retrieved March 27, 2024.","url":"https://research.checkpoint.com/2024/magnet-goblin-targets-publicly-facing-servers-using-1-day-vulnerabilities/"},{"source_name":"show_clock_detail_cisco_cmd","description":"Cisco. (2023, March 6). show clock detail - Cisco IOS Security Command Reference: Commands S to Z . Retrieved July 13, 2022.","url":"https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/s1/sec-s1-cr-book/sec-cr-s2.html#wp1896741674"},{"source_name":"Mac Time Sync","description":"Cone, Matt. (2021, January 14). Synchronize your Mac's Clock with a Time Server. Retrieved March 27, 2024.","url":"https://www.macinstruct.com/tutorials/synchronize-your-macs-clock-with-a-time-server/"},{"source_name":"ESET DazzleSpy Jan 2022","description":"M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.","url":"https://www.welivesecurity.com/2022/01/25/watering-hole-deploys-new-macos-malware-dazzlespy-asia/"},{"source_name":"AnyRun TimeBomb","description":"Malicious History. (2020, September 17). Time Bombs: Malware With Delayed Execution. Retrieved April 22, 2021.","url":"https://any.run/cybersecurity-blog/time-bombs-malware-with-delayed-execution/"},{"source_name":"Technet Windows Time Service","description":"Mathers, B. (2016, September 30). Windows Time Service Tools and Settings. Retrieved November 25, 2016.","url":"https://technet.microsoft.com/windows-server-docs/identity/ad-ds/get-started/windows-time-service/windows-time-service-tools-and-settings"},{"source_name":"MSDN System Time","description":"Microsoft. (n.d.). System Time. Retrieved November 25, 2016.","url":"https://msdn.microsoft.com/ms724961.aspx"},{"source_name":"RSA EU12 They're Inside","description":"Rivner, U., Schwartz, E. (2012). They’re Inside… Now What?. Retrieved November 25, 2016.","url":"https://www.rsaconference.com/writable/presentations/file_upload/ht-209_rivner_schwartz.pdf"},{"source_name":"System Information Discovery Technique","description":"YUCEEL, Huseyin Can. Picus Labs. (2022, June 9). The System Information Discovery Technique Explained - MITRE ATT&CK T1082. Retrieved March 27, 2024.","url":"https://www.picussecurity.com/resource/the-system-information-discovery-technique-explained-mitre-attack-t1082"},{"source_name":"Virtualization/Sandbox Evasion","description":"YUCEEL, Huseyin Can. Picus Labs. (2022, June 9). Virtualization/Sandbox Evasion - How Attackers Avoid Malware Analysis. Retrieved December 26, 2023.","url":"https://www.picussecurity.com/resource/virtualization/sandbox-evasion-how-attackers-avoid-malware-analysis"}],"platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem","virtualization"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0064","name":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component","category":"Script and command execution","description":"Execution of a command and its interpreter or parent context.","collection_focus":"Collect process command lines and relevant shell/interpreter audit; shell history alone is neither complete nor tamper-resistant.","providers":[{"name":"PowerShell Script Block Logging","scope":"Script content via event 4104 when configured; channel depends on PowerShell edition.","source_id":"powershell"},{"name":"Sysmon process events","scope":"Interpreter launch and parent context, not full script content.","source_id":"sysmon"},{"name":"Linux Audit","scope":"execve-family execution context; shell built-ins need additional instrumentation.","source_id":"linux"}],"configuration":["Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.","Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.","On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records."],"configuration_example":null,"required_fields":["interpreter","command_line","actor_uid","session_id"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.","sources":[{"id":"powershell","title":"Microsoft PowerShell logging on Windows","url":"https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.5"},{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Per host role and principal: rare interpreters, command argument patterns and parent-child sequences. Normalize scripts carefully; obfuscation, administrative automation and missing command lines change visibility."},{"id":"DC0039","name":"File Creation","page":"telemetry/DC0039/","kind":"attack_component","category":"Endpoint activity","description":"Creation or overwrite of a file at an observed path.","collection_focus":"Scope Sysmon FileCreate (11) to the lab directory; retain the process and file path. Differentiate creation/overwrite if the sensor can.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_id","path","action","size_bytes"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0039","collector":"illustrative-lab-collector","observation":{"process_id":4200,"path":"C:\\Lab\\demo.txt","action":"create","size_bytes":64}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0061","name":"File Modification","page":"telemetry/DC0061/","kind":"attack_component","category":"Endpoint activity","description":"Changes to file data or attributes.","collection_focus":"Use file-integrity monitoring or scoped OS file-write auditing for general changes. Sysmon 2 records creation-time changes; it is not a general file-write event.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["path","attribute","before","after"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0061","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","attribute":"content_hash","before":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","after":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0016","name":"Module Load","page":"telemetry/DC0016/","kind":"attack_component","category":"Endpoint activity","description":"A module or library being loaded into a running process.","collection_focus":"Scope Sysmon ImageLoad (7) to lab processes/paths; retain module hash, signer and destination process. Inventory alone does not prove a module loaded.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_id","image_loaded","signed","action"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0016","collector":"illustrative-lab-collector","observation":{"process_id":4200,"image_loaded":"C:\\Lab\\demo.dll","signed":false,"action":"load"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0021","name":"OS API Execution","page":"telemetry/DC0021/","kind":"attack_component","category":"Application and service audit","description":"Instrumented operating-system API calls and their return values.","collection_focus":"Use an approved EDR trace or instrument the owned lab process at selected APIs. Define API name, caller, sanitized arguments and return status.","providers":[{"name":"Application audit logs","scope":"First-party service events and request/result fields; schema is application-specific.","source_id":"otel"},{"name":"OpenTelemetry-compatible log pipelines","scope":"Transport and normalization of emitted records; do not create missing audit instrumentation.","source_id":"otel"}],"configuration":["Enable the application audit category or instrument the owned lab application at the authorization/action boundary.","Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.","Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart."],"configuration_example":null,"required_fields":["process_id","api","path","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0021","collector":"illustrative-lab-collector","observation":{"process_id":4200,"api":"CreateFileW","path":"C:\\Lab\\demo.txt","result":"success"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.","sources":[{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per application, client and route: request rate, rare actions, failure ratios and unusual state transitions. Version changes, retries, health probes and seasonal load need separate baselines."},{"id":"DC0035","name":"Process Access","page":"telemetry/DC0035/","kind":"attack_component","category":"Endpoint activity","description":"One process opening or accessing another process.","collection_focus":"Scope Sysmon ProcessAccess (10) to the selected source/target processes and access rights; retain call-trace fields where emitted.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["source_process_id","target_process_id","granted_access","action"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0035","collector":"illustrative-lab-collector","observation":{"source_process_id":4200,"target_process_id":4300,"granted_access":"0x1000","action":"open_process"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0034","name":"Process Metadata","page":"telemetry/DC0034/","kind":"attack_component","category":"Host state and inventory","description":"Point-in-time process properties such as owner, executable and start time.","collection_focus":"Collect read-only process inventory with PID plus start time/stable identity, command line and collection time; restrict access to potentially sensitive arguments.","providers":[{"name":"osquery","scope":"Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.","source_id":"osquery"},{"name":"Linux Audit plus inventory snapshots","scope":"Events explain changes; snapshots describe state at collection time.","source_id":"linux"}],"configuration":["Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.","Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.","Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset."],"configuration_example":null,"required_fields":["process_id","image","owner_uid","started_at"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0034","collector":"illustrative-lab-collector","observation":{"process_id":4200,"image":"/usr/bin/sleep","owner_uid":1000,"started_at":"2026-09-27T11:59:00Z"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.","sources":[{"id":"osquery","title":"osquery scheduled configuration","url":"https://github.com/osquery/osquery/blob/master/docs/wiki/deployment/configuration.md"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Compare authorized state snapshots: first-seen drivers/services/modules, unexpected configuration drift and integrity changes. Record collection cadence; absence in a sample is not evidence of deletion."},{"id":"DC0001","name":"Scheduled Job Creation","page":"telemetry/DC0001/","kind":"attack_component","category":"Windows and directory audit","description":"Creation of a scheduled execution object, including its trigger, principal and executable action.","collection_focus":"Enable Audit Other Object Access Events for Windows task creation (4698); retain task XML. For cron/systemd timers, collect scheduler definitions and change events separately.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["task_name","action","principal","schedule","program"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0001","collector":"illustrative-lab-collector","observation":{"task_name":"LabDailyCheck","action":"create","principal":"lab-user","schedule":"daily","program":"lab-check.exe"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0005","name":"Scheduled Job Metadata","page":"telemetry/DC0005/","kind":"attack_component","category":"Host state and inventory","description":"Current task or scheduler configuration: command, owner, trigger and enabled state.","collection_focus":"Snapshot Task Scheduler, cron or systemd timer definitions at a documented interval and preserve complete task identity.","providers":[{"name":"osquery","scope":"Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.","source_id":"osquery"},{"name":"Linux Audit plus inventory snapshots","scope":"Events explain changes; snapshots describe state at collection time.","source_id":"linux"}],"configuration":["Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.","Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.","Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset."],"configuration_example":null,"required_fields":["task_name","enabled","principal","last_observed"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0005","collector":"illustrative-lab-collector","observation":{"task_name":"LabDailyCheck","enabled":true,"principal":"lab-user","last_observed":"2026-09-27T12:00:00Z"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.","sources":[{"id":"osquery","title":"osquery scheduled configuration","url":"https://github.com/osquery/osquery/blob/master/docs/wiki/deployment/configuration.md"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Compare authorized state snapshots: first-seen drivers/services/modules, unexpected configuration drift and integrity changes. Record collection cadence; absence in a sample is not evidence of deletion."},{"id":"DC0002","name":"User Account Authentication","page":"telemetry/DC0002/","kind":"attack_component","category":"Identity and SaaS","description":"Authentication attempts and outcomes for a user or workload account.","collection_focus":"Collect successful and failed sign-ins, authentication method, application and conditional-access context; distinguish account validation from session creation.","providers":[{"name":"Microsoft Entra sign-in logs","scope":"Interactive, non-interactive and workload sign-in contexts, subject to tenant features and access.","source_id":"entra"},{"name":"Cloud identity service audit","scope":"Issuer-side credential and administrative events where the service supports them.","source_id":"cloudtrail"},{"name":"Application audit instrumentation","scope":"Application-side use of identities and sessions; design fields without raw tokens.","source_id":"otel"}],"configuration":["Enable/export the required identity sign-in and audit categories from the lab tenant to a protected destination. Document license, role and retention requirements.","Correlate issuance or administrative changes with later sign-ins using non-secret credential IDs, application IDs, user IDs and correlation IDs.","Exclude passwords, bearer tokens, cookies and private keys. Record success, failure, authentication context and application result separately."],"configuration_example":null,"required_fields":["account","application","result","reason","source_ip"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0002","collector":"illustrative-lab-collector","observation":{"account":"analyst@example.test","application":"lab-portal","result":"failure","reason":"invalid_credential","source_ip":"192.0.2.10"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A token creation record is not evidence of token use; a sign-in is not a complete record of every resource access. Some provider-side data is unavailable to the customer.","sources":[{"id":"entra","title":"Microsoft Entra sign-in logs","url":"https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-sign-ins"},{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per identity and application: first-seen clients/resources, changes in authentication failures and session patterns, and unusual permission changes. Separate automation, travel, shared egress and identity-provider policy changes."}],"detection":{"key":"enterprise/T1124","id":"T1124","name":"System Time Discovery","domain":"enterprise","platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem","virtualization"],"source_url":"https://attack.mitre.org/techniques/T1124","technique_page":"techniques/enterprise/T1124/","page":"detections/enterprise/T1124/","status":"rule_source_available","counts":{"sigma":3,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"sigma_rules":[{"id":"9705a6a1-6db6-4a16-a987-15b7151e299b","title":"Cisco Discovery","status":"test","level":"low","logsource":{"product":"cisco","service":"aaa"},"data_path":"data/detection-rules/9705a6a1-6db6-4a16-a987-15b7151e299b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/network/cisco/aaa/cisco_cli_discovery.yml","author":"Austin Clark","kind":"sigma"},{"id":"b243b280-65fe-48df-ba07-6ddea7646427","title":"Discovery of a System Time","status":"test","level":"low","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/b243b280-65fe-48df-ba07-6ddea7646427.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_remote_time_discovery.yml","author":"E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community","kind":"sigma"},{"id":"6da2c9f5-7c53-401b-aacb-92c040ce1215","title":"Use of W32tm as Timer","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/6da2c9f5-7c53-401b-aacb-92c040ce1215.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_w32tm.yml","author":"frack113","kind":"sigma"}],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0151","name":"Behavior-chain, platform-aware detection strategy for T1124 System Time Discovery","url":"https://attack.mitre.org/detectionstrategies/DET0151","stix_id":"x-mitre-detection-strategy--98ae5e06-7ea5-49b9-b793-7f97b1d306b2","relationship_id":"relationship--a471c195-dbf1-4c84-a314-393189769d31","description":"","analytics":[{"id":"AN0430","name":"Analytic 0430","guidance":"Untrusted or unusual process/script (cmd.exe, powershell.exe, w32tm.exe, net.exe, custom binaries) queries system time/timezone (e.g., w32tm /tz, net time \\\\host, Get-TimeZone, GetTickCount API) and (optionally) is followed within a short window by time-based scheduling or conditional execution (e.g., schtasks /create, at.exe, PowerShell Start-Sleep with large values).","url":"https://attack.mitre.org/detectionstrategies/DET0151#AN0430","platforms":["Windows"],"tuning":[{"field":"TimeWindow","description":"Correlation window (e.g., 5–15 minutes) between time discovery and follow-on scheduling/conditional actions."},{"field":"AllowedParents","description":"Legitimate parent processes (e.g., corporate scripts, management agents) that frequently call time APIs."},{"field":"CommandlineKeywordList","description":"Extend/restrict keyword list for time queries (e.g., custom PS functions, .NET calls)."},{"field":"UserContextScope","description":"Restrict to non-service, non-administrative, or newly created/rare users."},{"field":"ProcessPrevalenceThreshold","description":"Frequency threshold to exclude common estate-wide benign usage."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Security","channel":"EventCode=4688","platforms":["Windows"],"analytic_id":"AN0430","source_url":"https://attack.mitre.org/detectionstrategies/DET0151#AN0430","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0016","component":"Module Load","name":"WinEventLog:Sysmon","channel":"EventCode=7","platforms":["Windows"],"analytic_id":"AN0430","source_url":"https://attack.mitre.org/detectionstrategies/DET0151#AN0430","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0016/"},{"component_id":"DC0035","component":"Process Access","name":"WinEventLog:Sysmon","channel":"EventCode=10","platforms":["Windows"],"analytic_id":"AN0430","source_url":"https://attack.mitre.org/detectionstrategies/DET0151#AN0430","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0035/"},{"component_id":"DC0039","component":"File Creation","name":"WinEventLog:Sysmon","channel":"EventCode=11","platforms":["Windows"],"analytic_id":"AN0430","source_url":"https://attack.mitre.org/detectionstrategies/DET0151#AN0430","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0039/"},{"component_id":"DC0064","component":"Command Execution","name":"WinEventLog:PowerShell","channel":"EventCode=4103, 4104, 4105, 4106","platforms":["Windows"],"analytic_id":"AN0430","source_url":"https://attack.mitre.org/detectionstrategies/DET0151#AN0430","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"},{"component_id":"DC0021","component":"OS API Execution","name":"etw:Microsoft-Windows-Kernel-Process","channel":"High-frequency or suspicious sequence of QueryPerformanceCounter/GetTickCount API calls from a non-standard process lineage","platforms":["Windows"],"analytic_id":"AN0430","source_url":"https://attack.mitre.org/detectionstrategies/DET0151#AN0430","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0021/"},{"component_id":"DC0001","component":"Scheduled Job Creation","name":"WinEventLog:TaskScheduler","channel":"EventCode=106","platforms":["Windows"],"analytic_id":"AN0430","source_url":"https://attack.mitre.org/detectionstrategies/DET0151#AN0430","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0001/"},{"component_id":"DC0005","component":"Scheduled Job Metadata","name":"WinEventLog:TaskScheduler","channel":"Task registration/execution shortly after a time discovery event","platforms":["Windows"],"analytic_id":"AN0430","source_url":"https://attack.mitre.org/detectionstrategies/DET0151#AN0430","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0005/"},{"component_id":"DC0034","component":"Process Metadata","name":"EDR:Telemetry","channel":"Process lineage and API usage enrichment (GetSystemTime, GetTimeZoneInformation, NtQuerySystemTime)","platforms":["Windows"],"analytic_id":"AN0430","source_url":"https://attack.mitre.org/detectionstrategies/DET0151#AN0430","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0034/"}]},{"id":"AN0431","name":"Analytic 0431","guidance":"A process (often spawned by a shell, interpreter, or malware implant) executes time discovery via commands (date, timedatectl, hwclock, cat /etc/timezone, /proc/uptime) or direct syscalls (time(), clock_gettime) and is (optionally) followed by scheduled task creation/modification (crontab, at) or conditional sleep logic.","url":"https://attack.mitre.org/detectionstrategies/DET0151#AN0431","platforms":["Linux"],"tuning":[{"field":"AuditRulesSyscalls","description":"Scope of syscalls (time, clock_gettime, gettimeofday) monitored; may be performance-sensitive."},{"field":"AllowedBinaries","description":"List of legitimate automation/orchestration tools frequently querying time."},{"field":"TimeWindow","description":"Correlation window (e.g., 5–20 minutes) to link time discovery to follow-on cron/at changes."},{"field":"UserContextScope","description":"Ignore root-owned maintenance agents if desired; focus on interactive or newly created users."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"auditd:SYSCALL","channel":"type=EXECVE or SYSCALL for /bin/date, /usr/bin/timedatectl, /sbin/hwclock, /bin/cat /etc/timezone, /bin/cat /proc/uptime","platforms":["Linux"],"analytic_id":"AN0431","source_url":"https://attack.mitre.org/detectionstrategies/DET0151#AN0431","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0021","component":"OS API Execution","name":"auditd:SYSCALL","channel":"Rules capturing clock_gettime, time, gettimeofday syscalls when enabled","platforms":["Linux"],"analytic_id":"AN0431","source_url":"https://attack.mitre.org/detectionstrategies/DET0151#AN0431","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0021/"},{"component_id":"DC0002","component":"User Account Authentication","name":"linux:syslog","channel":"sudo/date/timedatectl execution by non-standard users","platforms":["Linux"],"analytic_id":"AN0431","source_url":"https://attack.mitre.org/detectionstrategies/DET0151#AN0431","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0002/"},{"component_id":"DC0005","component":"Scheduled Job Metadata","name":"linux:cron","channel":"cron activity","platforms":["Linux"],"analytic_id":"AN0431","source_url":"https://attack.mitre.org/detectionstrategies/DET0151#AN0431","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0005/"}]},{"id":"AN0432","name":"Analytic 0432","guidance":"Process/script execution of systemsetup -gettimezone, date, ioreg, or API usage (timeIntervalSinceNow, gettimeofday) followed by time-based scheduling (launchd plist modification) or sleep-based execution.","url":"https://attack.mitre.org/detectionstrategies/DET0151#AN0432","platforms":["macOS"],"tuning":[{"field":"LaunchdPaths","description":"Organization-specific list of allowed launchd write locations to filter benign agents."},{"field":"TimeWindow","description":"Correlation window to link time discovery to launchd persistence/scheduling."},{"field":"AllowedCallers","description":"Known management agents (e.g., JAMF) that legitimately call systemsetup/date."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"macos:unifiedlog","channel":"process exec events of systemsetup, date, ioreg with command_line parameters indicating time discovery","platforms":["macOS"],"analytic_id":"AN0432","source_url":"https://attack.mitre.org/detectionstrategies/DET0151#AN0432","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0005","component":"Scheduled Job Metadata","name":"macos:unifiedlog","channel":"New/modified launchd plist (persistence/scheduling) within TimeWindow after time query","platforms":["macOS"],"analytic_id":"AN0432","source_url":"https://attack.mitre.org/detectionstrategies/DET0151#AN0432","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0005/"}]},{"id":"AN0433","name":"Analytic 0433","guidance":"Interactive or remote shell/API invocation of esxcli system clock get or querying time parameters via hostd/vpxa shortly followed by time/ntp configuration checks or scheduled task creation, executed by non-standard accounts or outside maintenance windows.","url":"https://attack.mitre.org/detectionstrategies/DET0151#AN0433","platforms":["ESXi"],"tuning":[{"field":"MaintenanceWindow","description":"Only alert if outside approved ops windows."},{"field":"PrivilegedAccountsAllowList","description":"Suppress alerts for known service accounts."},{"field":"RemoteIPAllowList","description":"Whitelist management station IPs."},{"field":"TimeWindow","description":"Correlation between esxcli time query and subsequent hostd/vpxa config calls."}],"log_sources":[{"component_id":"DC0064","component":"Command Execution","name":"esxi:shell","channel":"/var/log/shell.log entries containing \"esxcli system clock get\"","platforms":["ESXi"],"analytic_id":"AN0433","source_url":"https://attack.mitre.org/detectionstrategies/DET0151#AN0433","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"},{"component_id":"DC0034","component":"Process Metadata","name":"esxi:hostd","channel":"/var/log/hostd.log API calls reading/altering time/ntp settings","platforms":["ESXi"],"analytic_id":"AN0433","source_url":"https://attack.mitre.org/detectionstrategies/DET0151#AN0433","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0034/"},{"component_id":"DC0005","component":"Scheduled Job Metadata","name":"esxi:syslog","channel":"/var/log/vpxa.log task invocations tied to time configuration","platforms":["ESXi"],"analytic_id":"AN0433","source_url":"https://attack.mitre.org/detectionstrategies/DET0151#AN0433","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0005/"}]},{"id":"AN0434","name":"Analytic 0434","guidance":"Non-standard or rare users/locations issue CLI commands like \"show clock detail\" or \"show timezone\"; optionally followed by configuration of time/timezone or NTP sources. AAA/TACACS+ accounting and syslog correlate execution to identity, source IP, and privilege level.","url":"https://attack.mitre.org/detectionstrategies/DET0151#AN0434","platforms":["Network Devices"],"tuning":[{"field":"AllowedAdminSubnets","description":"Only alert on access from outside the NOC/management subnets."},{"field":"KnownMaintenanceUsers","description":"Whitelist known automation/orchestration accounts."},{"field":"TimeWindow","description":"Correlation window between time query and config change."}],"log_sources":[{"component_id":"DC0064","component":"Command Execution","name":"networkdevice:syslog","channel":"command-exec: CLI commands containing \"show clock\", \"show clock detail\", \"show timezone\" executed by suspicious user/source","platforms":["Network Devices"],"analytic_id":"AN0434","source_url":"https://attack.mitre.org/detectionstrategies/DET0151#AN0434","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"},{"component_id":"DC0061","component":"File Modification","name":"networkdevice:config","channel":"config-change: timezone or ntp server configuration change after a time query command","platforms":["Network Devices"],"analytic_id":"AN0434","source_url":"https://attack.mitre.org/detectionstrategies/DET0151#AN0434","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0061/"}]}]}],"telemetry_references":[{"id":"DC0064","name":"Command Execution","tag":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component"},{"id":"DC0039","name":"File Creation","tag":"File Creation","page":"telemetry/DC0039/","kind":"attack_component"},{"id":"DC0061","name":"File Modification","tag":"File Modification","page":"telemetry/DC0061/","kind":"attack_component"},{"id":"DC0016","name":"Module Load","tag":"Module Load","page":"telemetry/DC0016/","kind":"attack_component"},{"id":"DC0021","name":"OS API Execution","tag":"OS API Execution","page":"telemetry/DC0021/","kind":"attack_component"},{"id":"DC0035","name":"Process Access","tag":"Process Access","page":"telemetry/DC0035/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"},{"id":"DC0034","name":"Process Metadata","tag":"Process Metadata","page":"telemetry/DC0034/","kind":"attack_component"},{"id":"DC0001","name":"Scheduled Job Creation","tag":"Scheduled Job Creation","page":"telemetry/DC0001/","kind":"attack_component"},{"id":"DC0005","name":"Scheduled Job Metadata","tag":"Scheduled Job Metadata","page":"telemetry/DC0005/","kind":"attack_component"},{"id":"DC0002","name":"User Account Authentication","tag":"User Account Authentication","page":"telemetry/DC0002/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S1087","name":"AsyncRAT","page":"tools/S1087/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0039","name":"Net","page":"tools/S0039/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0692","name":"SILENTTRINITY","page":"tools/S0692/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S1087","name":"AsyncRAT","page":"tools/S1087/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0039","name":"Net","page":"tools/S0039/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0692","name":"SILENTTRINITY","page":"tools/S0692/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"software":[{"id":"S0011","name":"Taidoor","url":"https://attack.mitre.org/software/S0011","kind":"malware","description":"[Taidoor](https://attack.mitre.org/software/S0011) can use <code>GetLocalTime</code> and <code>GetSystemTime</code> to collect system time.(Citation: CISA MAR-10292089-1.v2 TAIDOOR August 2021)","relationship_id":"relationship--08d7395b-b3e6-4ae2-be46-31347d1d5eaa","references":[{"source_name":"CISA MAR-10292089-1.v2 TAIDOOR August 2021","description":"CISA, FBI, DOD. (2021, August). MAR-10292089-1.v2 – Chinese Remote Access Trojan: TAIDOOR. Retrieved August 24, 2021.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-216a"}]},{"id":"S0013","name":"PlugX","url":"https://attack.mitre.org/software/S0013","kind":"malware","description":"[PlugX](https://attack.mitre.org/software/S0013) has identified system time through its GetSystemInfo command.(Citation: Eset PlugX Korplug Mustang Panda March 2022)","relationship_id":"relationship--44de6f93-f752-41cd-9372-0e0280c51ee9","references":[{"source_name":"Eset PlugX Korplug Mustang Panda March 2022","description":"Alexandre Cote Cyr. (2022, March 23). Mustang Panda’s Hodur: Old tricks, new Korplug variant. Retrieved September 9, 2025.","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"}]},{"id":"S0017","name":"BISCUIT","url":"https://attack.mitre.org/software/S0017","kind":"malware","description":"[BISCUIT](https://attack.mitre.org/software/S0017) has a command to collect the system `UPTIME`.(Citation: Mandiant APT1)","relationship_id":"relationship--7e2d9f42-18be-4b95-9300-db7d6afa50ec","references":[{"source_name":"Mandiant APT1","description":"Mandiant. (n.d.). APT1 Exposing One of China’s Cyber Espionage Units. Retrieved July 18, 2016.","url":"https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"}]},{"id":"S0039","name":"Net","url":"https://attack.mitre.org/software/S0039","kind":"tool","description":"The <code>net time</code> command can be used in [Net](https://attack.mitre.org/software/S0039) to determine the local or remote system time.(Citation: TechNet Net Time)","relationship_id":"relationship--12455fe5-42dd-420e-839e-8a96886488f7","references":[{"source_name":"TechNet Net Time","description":"Microsoft. (n.d.). Net time. Retrieved November 25, 2016.","url":"https://technet.microsoft.com/bb490716.aspx"}]},{"id":"S0091","name":"Epic","url":"https://attack.mitre.org/software/S0091","kind":"malware","description":"[Epic](https://attack.mitre.org/software/S0091) uses the <code>net time</code> command  to get the system time from the machine and collect the current date and time zone information.(Citation: Kaspersky Turla)","relationship_id":"relationship--16f64842-8ba8-4827-a47f-e7d665f942ae","references":[{"source_name":"Kaspersky Turla","description":"Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.","url":"https://securelist.com/the-epic-turla-operation/65545/"}]},{"id":"S0098","name":"T9000","url":"https://attack.mitre.org/software/S0098","kind":"malware","description":"[T9000](https://attack.mitre.org/software/S0098) gathers and beacons the system time during installation.(Citation: Palo Alto T9000 Feb 2016)","relationship_id":"relationship--0d2a66c5-fb8e-4cbb-9526-579b5c9c881c","references":[{"source_name":"Palo Alto T9000 Feb 2016","description":"Grunzweig, J. and Miller-Osborn, J.. (2016, February 4). T9000: Advanced Modular Backdoor Uses Complex Anti-Analysis Techniques. Retrieved April 15, 2016.","url":"http://researchcenter.paloaltonetworks.com/2016/02/t9000-advanced-modular-backdoor-uses-complex-anti-analysis-techniques/"}]},{"id":"S0115","name":"Crimson","url":"https://attack.mitre.org/software/S0115","kind":"malware","description":"[Crimson](https://attack.mitre.org/software/S0115) has the ability to determine the date and time on a compromised host.(Citation: Kaspersky Transparent Tribe August 2020)","relationship_id":"relationship--4a5b8515-18ee-45bb-a1e7-48ede93bf56a","references":[{"source_name":"Kaspersky Transparent Tribe August 2020","description":"Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021.","url":"https://securelist.com/transparent-tribe-part-1/98127/"}]},{"id":"S0126","name":"ComRAT","url":"https://attack.mitre.org/software/S0126","kind":"malware","description":"[ComRAT](https://attack.mitre.org/software/S0126) has checked the victim system's date and time to perform tasks during business hours (9 to 5, Monday to Friday).(Citation: CISA ComRAT Oct 2020) ","relationship_id":"relationship--c7c1411a-42c8-4d7e-9b56-0465370759de","references":[{"source_name":"CISA ComRAT Oct 2020","description":"CISA. (2020, October 29). Malware Analysis Report (AR20-303A). Retrieved December 9, 2020.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-303a"}]},{"id":"S0139","name":"PowerDuke","url":"https://attack.mitre.org/software/S0139","kind":"malware","description":"[PowerDuke](https://attack.mitre.org/software/S0139) has commands to get the time the machine was built, the time, and the time zone.(Citation: Volexity PowerDuke November 2016)","relationship_id":"relationship--6b38f460-e309-4ab1-bbc9-bd0bb30f4af9","references":[{"source_name":"Volexity PowerDuke November 2016","description":"Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.","url":"https://www.volexity.com/blog/2016/11/09/powerduke-post-election-spear-phishing-campaigns-targeting-think-tanks-and-ngos/"}]},{"id":"S0140","name":"Shamoon","url":"https://attack.mitre.org/software/S0140","kind":"malware","description":"[Shamoon](https://attack.mitre.org/software/S0140) obtains the system time and will only activate if it is greater than a preset date.(Citation: Palo Alto Shamoon Nov 2016)(Citation: Unit 42 Shamoon3 2018)","relationship_id":"relationship--0024d82d-97ea-4dc5-81a1-8738862e1f3b","references":[{"source_name":"Palo Alto Shamoon Nov 2016","description":"Falcone, R.. (2016, November 30). Shamoon 2: Return of the Disttrack Wiper. Retrieved January 11, 2017.","url":"http://researchcenter.paloaltonetworks.com/2016/11/unit42-shamoon-2-return-disttrack-wiper/"},{"source_name":"Unit 42 Shamoon3 2018","description":"Falcone, R. (2018, December 13). Shamoon 3 Targets Oil and Gas Organization. Retrieved March 14, 2019.","url":"https://unit42.paloaltonetworks.com/shamoon-3-targets-oil-gas-organization/"}]},{"id":"S0148","name":"RTM","url":"https://attack.mitre.org/software/S0148","kind":"malware","description":"[RTM](https://attack.mitre.org/software/S0148) can obtain the victim time zone.(Citation: ESET RTM Feb 2017)","relationship_id":"relationship--4c3890f0-378d-4cef-8db7-0258161ff3f7","references":[{"source_name":"ESET RTM Feb 2017","description":"Faou, M. and Boutin, J. (2017, February). Read The Manual: A Guide to the RTM Banking Trojan. Retrieved March 9, 2017.","url":"https://www.welivesecurity.com/wp-content/uploads/2017/02/Read-The-Manual.pdf"}]},{"id":"S0149","name":"MoonWind","url":"https://attack.mitre.org/software/S0149","kind":"malware","description":"[MoonWind](https://attack.mitre.org/software/S0149) obtains the victim's current time.(Citation: Palo Alto MoonWind March 2017)","relationship_id":"relationship--77c63e89-71fe-47e3-babb-13e7722932ad","references":[{"source_name":"Palo Alto MoonWind March 2017","description":"Miller-Osborn, J. and Grunzweig, J.. (2017, March 30). Trochilus and New MoonWind RATs Used In Attack Against Thai Organizations. Retrieved March 30, 2017.","url":"http://researchcenter.paloaltonetworks.com/2017/03/unit42-trochilus-rat-new-moonwind-rat-used-attack-thai-utility-organizations/"}]},{"id":"S0237","name":"GravityRAT","url":"https://attack.mitre.org/software/S0237","kind":"malware","description":"[GravityRAT](https://attack.mitre.org/software/S0237) can obtain the date and time of a system.(Citation: Talos GravityRAT)","relationship_id":"relationship--33e3573b-0f18-417c-be17-727863fc21ec","references":[{"source_name":"Talos GravityRAT","description":"Mercer, W., Rascagneres, P. (2018, April 26). GravityRAT - The Two-Year Evolution Of An APT Targeting India. Retrieved May 16, 2018.","url":"https://blog.talosintelligence.com/2018/04/gravityrat-two-year-evolution-of-apt.html"}]},{"id":"S0238","name":"Proxysvc","url":"https://attack.mitre.org/software/S0238","kind":"malware","description":"As part of the data reconnaissance phase, [Proxysvc](https://attack.mitre.org/software/S0238) grabs the system time to send back to the control server.(Citation: McAfee GhostSecret)","relationship_id":"relationship--d8427910-3c8f-4633-966f-e1a2a8d7c31c","references":[{"source_name":"McAfee GhostSecret","description":"Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018.","url":"https://securingtomorrow.mcafee.com/mcafee-labs/analyzing-operation-ghostsecret-attack-seeks-to-steal-data-worldwide/"}]},{"id":"S0251","name":"Zebrocy","url":"https://attack.mitre.org/software/S0251","kind":"malware","description":"[Zebrocy](https://attack.mitre.org/software/S0251) gathers the current time zone and date information from the system.(Citation: ESET Zebrocy Nov 2018)(Citation: CISA Zebrocy Oct 2020)","relationship_id":"relationship--07eea18c-048c-4187-a6f1-ca97e9bfc846","references":[{"source_name":"ESET Zebrocy Nov 2018","description":"ESET. (2018, November 20). Sednit: What’s going on with Zebrocy?. Retrieved February 12, 2019.","url":"https://www.welivesecurity.com/2018/11/20/sednit-whats-going-zebrocy/"},{"source_name":"CISA Zebrocy Oct 2020","description":"CISA. (2020, October 29). Malware Analysis Report (AR20-303B). Retrieved December 9, 2020.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-303b"}]},{"id":"S0260","name":"InvisiMole","url":"https://attack.mitre.org/software/S0260","kind":"malware","description":"[InvisiMole](https://attack.mitre.org/software/S0260) gathers the local system time from the victim’s machine.(Citation: ESET InvisiMole June 2018)(Citation: ESET InvisiMole June 2020)","relationship_id":"relationship--e0292b89-50c2-4b62-8471-6a1b27dc7fc3","references":[{"source_name":"ESET InvisiMole June 2018","description":"Hromcová, Z. (2018, June 07). InvisiMole: Surprisingly equipped spyware, undercover since 2013. Retrieved July 10, 2018.","url":"https://www.welivesecurity.com/2018/06/07/invisimole-equipped-spyware-undercover/"},{"source_name":"ESET InvisiMole June 2020","description":"Hromcova, Z. and Cherpanov, A. (2020, June). INVISIMOLE: THE HIDDEN PART OF THE STORY. Retrieved July 16, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf"}]},{"id":"S0264","name":"OopsIE","url":"https://attack.mitre.org/software/S0264","kind":"malware","description":"[OopsIE](https://attack.mitre.org/software/S0264) checks to see if the system is configured with \"Daylight\" time and checks for a specific region to be set for the timezone.(Citation: Unit 42 OilRig Sept 2018)","relationship_id":"relationship--db4fbefd-e9ed-495a-89af-67c4b6780508","references":[{"source_name":"Unit 42 OilRig Sept 2018","description":"Falcone, R., et al. (2018, September 04). OilRig Targets a Middle Eastern Government and Adds Evasion Techniques to OopsIE. Retrieved September 24, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/09/unit42-oilrig-targets-middle-eastern-government-adds-evasion-techniques-oopsie/"}]},{"id":"S0267","name":"FELIXROOT","url":"https://attack.mitre.org/software/S0267","kind":"malware","description":"[FELIXROOT](https://attack.mitre.org/software/S0267) gathers the time zone information from the victim’s machine.(Citation: ESET GreyEnergy Oct 2018)","relationship_id":"relationship--8b6dbaf7-d578-4bc6-8f16-07e7c1aeedc8","references":[{"source_name":"ESET GreyEnergy Oct 2018","description":"Cherepanov, A. (2018, October). GREYENERGY A successor to BlackEnergy. Retrieved November 15, 2018.","url":"https://www.welivesecurity.com/wp-content/uploads/2018/10/ESET_GreyEnergy.pdf"}]},{"id":"S0268","name":"Bisonal","url":"https://attack.mitre.org/software/S0268","kind":"malware","description":"[Bisonal](https://attack.mitre.org/software/S0268) can check the system time set on the infected host.(Citation: Kaspersky CactusPete Aug 2020)","relationship_id":"relationship--e7622538-5858-4804-960e-e9ef427a1a43","references":[{"source_name":"Kaspersky CactusPete Aug 2020","description":"Zykov, K. (2020, August 13). CactusPete APT group’s updated Bisonal backdoor. Retrieved May 5, 2021.","url":"https://securelist.com/cactuspete-apt-groups-updated-bisonal-backdoor/97962/"}]},{"id":"S0275","name":"UPPERCUT","url":"https://attack.mitre.org/software/S0275","kind":"malware","description":"[UPPERCUT](https://attack.mitre.org/software/S0275) has the capability to obtain the time zone information and the current timestamp of the victim’s machine.(Citation: FireEye APT10 Sept 2018)","relationship_id":"relationship--242236fe-a0b6-4cf0-b604-beb57ce9925a","references":[{"source_name":"FireEye APT10 Sept 2018","description":"Matsuda, A., Muhammad I. (2018, September 13). APT10 Targeting Japanese Corporations Using Updated TTPs. Retrieved September 17, 2018.","url":"https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html"}]},{"id":"S0330","name":"Zeus Panda","url":"https://attack.mitre.org/software/S0330","kind":"malware","description":"[Zeus Panda](https://attack.mitre.org/software/S0330) collects the current system time (UTC) and sends it back to the C2 server.(Citation: GDATA Zeus Panda June 2017)","relationship_id":"relationship--9494b0d8-26d9-48ae-8dd1-c9d8966b23a0","references":[{"source_name":"GDATA Zeus Panda June 2017","description":"Ebach, L. (2017, June 22). Analysis Results of Zeus.Variant.Panda. Retrieved November 5, 2018.","url":"https://cyberwtf.files.wordpress.com/2017/07/panda-whitepaper.pdf"}]},{"id":"S0331","name":"Agent Tesla","url":"https://attack.mitre.org/software/S0331","kind":"malware","description":"[Agent Tesla](https://attack.mitre.org/software/S0331) can collect the timestamp from the victim’s machine.(Citation: DigiTrust Agent Tesla Jan 2017)","relationship_id":"relationship--38248217-7c11-4ae9-a13e-7296dead0df8","references":[{"source_name":"DigiTrust Agent Tesla Jan 2017","description":"The DigiTrust Group. (2017, January 12). The Rise of Agent Tesla. Retrieved November 5, 2018.","url":"https://www.digitrustgroup.com/agent-tesla-keylogger/"}]},{"id":"S0335","name":"Carbon","url":"https://attack.mitre.org/software/S0335","kind":"malware","description":"[Carbon](https://attack.mitre.org/software/S0335) uses the command <code>net time \\\\127.0.0.1</code> to get information the system’s time.(Citation: GovCERT Carbon May 2016)","relationship_id":"relationship--40a2c8e2-df1c-41a8-beec-951214c8e101","references":[{"source_name":"GovCERT Carbon May 2016","description":"GovCERT. (2016, May 23). Technical Report about the Espionage Case at RUAG. Retrieved November 7, 2018.","url":"https://web.archive.org/web/20170718174931/https://www.melani.admin.ch/dam/melani/de/dokumente/2016/technical%20report%20ruag.pdf.download.pdf/Report_Ruag-Espionage-Case.pdf"}]},{"id":"S0344","name":"Azorult","url":"https://attack.mitre.org/software/S0344","kind":"malware","description":"[Azorult](https://attack.mitre.org/software/S0344) can collect the time zone information from the system.(Citation: Unit42 Azorult Nov 2018)(Citation: Proofpoint Azorult July 2018)","relationship_id":"relationship--9d30b96a-6518-449e-a665-3033dfcb44db","references":[{"source_name":"Unit42 Azorult Nov 2018","description":"Yan, T., et al. (2018, November 21). New Wine in Old Bottle: New Azorult Variant Found in FindMyName Campaign using Fallout Exploit Kit. Retrieved November 29, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/11/unit42-new-wine-old-bottle-new-azorult-variant-found-findmyname-campaign-using-fallout-exploit-kit/"},{"source_name":"Proofpoint Azorult July 2018","description":"Proofpoint. (2018, July 30). New version of AZORult stealer improves loading features, spreads alongside ransomware in new campaign. Retrieved November 29, 2018.","url":"https://www.proofpoint.com/us/threat-insight/post/new-version-azorult-stealer-improves-loading-features-spreads-alongside"}]},{"id":"S0351","name":"Cannon","url":"https://attack.mitre.org/software/S0351","kind":"malware","description":"[Cannon](https://attack.mitre.org/software/S0351) can collect the current time zone information from the victim’s machine.(Citation: Unit42 Cannon Nov 2018)","relationship_id":"relationship--a3d44c1d-2833-4355-b560-2a7a4fcaac14","references":[{"source_name":"Unit42 Cannon Nov 2018","description":"Falcone, R., Lee, B. (2018, November 20). Sofacy Continues Global Attacks and Wheels Out New ‘Cannon’ Trojan. Retrieved November 26, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/11/unit42-sofacy-continues-global-attacks-wheels-new-cannon-trojan/"}]},{"id":"S0353","name":"NOKKI","url":"https://attack.mitre.org/software/S0353","kind":"malware","description":"[NOKKI](https://attack.mitre.org/software/S0353) can collect the current timestamp of the victim's machine.(Citation: Unit 42 NOKKI Sept 2018)","relationship_id":"relationship--4d9b9464-1ade-45e9-9d7b-1c4c967abd81","references":[{"source_name":"Unit 42 NOKKI Sept 2018","description":"Grunzweig, J., Lee, B. (2018, September 27). New KONNI Malware attacking Eurasia and Southeast Asia. Retrieved November 5, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/09/unit42-new-konni-malware-attacking-eurasia-southeast-asia/"}]},{"id":"S0373","name":"Astaroth","url":"https://attack.mitre.org/software/S0373","kind":"malware","description":"[Astaroth](https://attack.mitre.org/software/S0373) collects the timestamp from the infected machine. (Citation: Cofense Astaroth Sept 2018)","relationship_id":"relationship--04d60222-e8da-4de5-bc58-dcfae65986f5","references":[{"source_name":"Cofense Astaroth Sept 2018","description":"Doaty, J., Garrett, P.. (2018, September 10). We’re Seeing a Resurgence of the Demonic Astaroth WMIC Trojan. Retrieved September 25, 2024.","url":"https://web.archive.org/web/20200302071436/https://cofense.com/seeing-resurgence-demonic-astaroth-wmic-trojan/"}]},{"id":"S0376","name":"HOPLIGHT","url":"https://attack.mitre.org/software/S0376","kind":"malware","description":"[HOPLIGHT](https://attack.mitre.org/software/S0376) has been observed collecting system time from victim machines.(Citation: US-CERT HOPLIGHT Apr 2019)","relationship_id":"relationship--d060e004-9eb7-425e-924c-0555fa80e083","references":[{"source_name":"US-CERT HOPLIGHT Apr 2019","description":"US-CERT. (2019, April 10). MAR-10135536-8 – North Korean Trojan: HOPLIGHT. Retrieved April 19, 2019.","url":"https://www.us-cert.gov/ncas/analysis-reports/AR19-100A"}]},{"id":"S0380","name":"StoneDrill","url":"https://attack.mitre.org/software/S0380","kind":"malware","description":"[StoneDrill](https://attack.mitre.org/software/S0380) can obtain the current date and time of the victim machine.(Citation: Kaspersky StoneDrill 2017)\t","relationship_id":"relationship--54399f5a-a8ee-4f77-a363-23dd0033af12","references":[{"source_name":"Kaspersky StoneDrill 2017","description":"Kaspersky Lab. (2017, March 7). From Shamoon to StoneDrill: Wipers attacking Saudi organizations and beyond. Retrieved March 14, 2019.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07180722/Report_Shamoon_StoneDrill_final.pdf"}]},{"id":"S0396","name":"EvilBunny","url":"https://attack.mitre.org/software/S0396","kind":"malware","description":"[EvilBunny](https://attack.mitre.org/software/S0396) has used the API calls NtQuerySystemTime, GetSystemTimeAsFileTime, and GetTickCount to gather time metrics as part of its checks to see if the malware is running in a sandbox.(Citation: Cyphort EvilBunny Dec 2014)","relationship_id":"relationship--0c3f8b3b-a6a3-472c-b792-6f5c7ccfbb24","references":[{"source_name":"Cyphort EvilBunny Dec 2014","description":"Marschalek, M.. (2014, December 16). EvilBunny: Malware Instrumented By Lua. Retrieved June 28, 2019.","url":"https://web.archive.org/web/20150311013500/http://www.cyphort.com/evilbunny-malware-instrumented-lua/"}]},{"id":"S0417","name":"GRIFFON","url":"https://attack.mitre.org/software/S0417","kind":"malware","description":"[GRIFFON](https://attack.mitre.org/software/S0417) has used a reconnaissance module that can be used to retrieve the date and time of the system.(Citation: SecureList Griffon May 2019)\t","relationship_id":"relationship--3ce0fee3-3ad5-49b9-8213-871484674d93","references":[{"source_name":"SecureList Griffon May 2019","description":"Namestnikov, Y. and Aime, F. (2019, May 8). FIN7.5: the infamous cybercrime rig “FIN7” continues its activities. Retrieved October 11, 2019.","url":"https://securelist.com/fin7-5-the-infamous-cybercrime-rig-fin7-continues-its-activities/90703/"}]},{"id":"S0439","name":"Okrum","url":"https://attack.mitre.org/software/S0439","kind":"malware","description":"[Okrum](https://attack.mitre.org/software/S0439) can obtain the date and time of the compromised system.(Citation: ESET Okrum July 2019)","relationship_id":"relationship--e6f9ae1e-7002-4c62-be60-f45eca42061e","references":[{"source_name":"ESET Okrum July 2019","description":"Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2019/07/ESET_Okrum_and_Ketrican.pdf"}]},{"id":"S0450","name":"SHARPSTATS","url":"https://attack.mitre.org/software/S0450","kind":"malware","description":"[SHARPSTATS](https://attack.mitre.org/software/S0450) has the ability to identify the current date and time on the compromised host.(Citation: TrendMicro POWERSTATS V3 June 2019)","relationship_id":"relationship--e0b5c501-c949-4b60-8e2e-37a584dba8fe","references":[{"source_name":"TrendMicro POWERSTATS V3 June 2019","description":"Lunghi, D. and Horejsi, J.. (2019, June 10). MuddyWater Resurfaces, Uses Multi-Stage Backdoor POWERSTATS V3 and New Post-Exploitation Tools. Retrieved May 14, 2020.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/muddywater-resurfaces-uses-multi-stage-backdoor-powerstats-v3-and-new-post-exploitation-tools/"}]},{"id":"S0455","name":"Metamorfo","url":"https://attack.mitre.org/software/S0455","kind":"malware","description":"[Metamorfo](https://attack.mitre.org/software/S0455) uses JavaScript to get the system time.(Citation: Medium Metamorfo Apr 2020) ","relationship_id":"relationship--4a990ccb-7004-43b8-9328-37668e1a3b6d","references":[{"source_name":"Medium Metamorfo Apr 2020","description":"Erlich, C. (2020, April 3). The Avast Abuser: Metamorfo Banking Malware Hides By Abusing Avast Executable. Retrieved May 26, 2020.","url":"https://medium.com/@chenerlich/the-avast-abuser-metamorfo-banking-malware-hides-by-abusing-avast-executable-ac9b8b392767"}]},{"id":"S0466","name":"WindTail","url":"https://attack.mitre.org/software/S0466","kind":"malware","description":"[WindTail](https://attack.mitre.org/software/S0466) has the ability to generate the current date and time.(Citation: objective-see windtail1 dec 2018)","relationship_id":"relationship--ff019484-a6dc-4250-a9eb-9094f5c9d30f","references":[{"source_name":"objective-see windtail1 dec 2018","description":"Wardle, Patrick. (2018, December 20). Middle East Cyber-Espionage analyzing WindShift's implant: OSX.WindTail (part 1). Retrieved October 3, 2019.","url":"https://objective-see.com/blog/blog_0x3B.html"}]},{"id":"S0467","name":"TajMahal","url":"https://attack.mitre.org/software/S0467","kind":"malware","description":"[TajMahal](https://attack.mitre.org/software/S0467) has the ability to determine local time on a compromised host.(Citation: Kaspersky TajMahal April 2019)","relationship_id":"relationship--5c160f0c-1c12-4ab0-bd6e-a30f8d5bc168","references":[{"source_name":"Kaspersky TajMahal April 2019","description":"GReAT. (2019, April 10). Project TajMahal – a sophisticated new APT framework. Retrieved October 14, 2019.","url":"https://securelist.com/project-tajmahal/90240/"}]},{"id":"S0471","name":"build_downer","url":"https://attack.mitre.org/software/S0471","kind":"malware","description":"[build_downer](https://attack.mitre.org/software/S0471) has the ability to determine the local time to ensure malware installation only happens during the hours that the infected system is active.(Citation: Trend Micro Tick November 2019)","relationship_id":"relationship--56465210-d279-4982-a9fa-94a69f5b0b80","references":[{"source_name":"Trend Micro Tick November 2019","description":"Chen, J. et al. (2019, November). Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data. Retrieved June 9, 2020.","url":"https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"}]},{"id":"S0501","name":"PipeMon","url":"https://attack.mitre.org/software/S0501","kind":"malware","description":"[PipeMon](https://attack.mitre.org/software/S0501) can send time zone information from a compromised host to C2.(Citation: ESET PipeMon May 2020)","relationship_id":"relationship--96f5f2ec-28e6-4ed4-853e-9c6cadbe3dda","references":[{"source_name":"ESET PipeMon May 2020","description":"Tartare, M. et al. (2020, May 21). No “Game over” for the Winnti Group. Retrieved August 24, 2020.","url":"https://www.welivesecurity.com/2020/05/21/no-game-over-winnti-group/"}]},{"id":"S0531","name":"Grandoreiro","url":"https://attack.mitre.org/software/S0531","kind":"malware","description":"[Grandoreiro](https://attack.mitre.org/software/S0531) can determine the time on the victim machine via IPinfo.(Citation: ESET Grandoreiro April 2020)","relationship_id":"relationship--509a61b8-292e-4292-b4e8-c1c9901582ec","references":[{"source_name":"ESET Grandoreiro April 2020","description":"ESET. (2020, April 28). Grandoreiro: How engorged can an EXE get?. Retrieved November 13, 2020.","url":"https://www.welivesecurity.com/2020/04/28/grandoreiro-how-engorged-can-exe-get/"}]},{"id":"S0534","name":"Bazar","url":"https://attack.mitre.org/software/S0534","kind":"malware","description":"[Bazar](https://attack.mitre.org/software/S0534) can collect the time on the compromised host.(Citation: Cybereason Bazar July 2020)(Citation: NCC Group Team9 June 2020)","relationship_id":"relationship--6d9f427b-f016-4100-a30a-c13648536e81","references":[{"source_name":"Cybereason Bazar July 2020","description":"Cybereason Nocturnus. (2020, July 16). A BAZAR OF TRICKS: FOLLOWING TEAM9’S DEVELOPMENT CYCLES. Retrieved November 18, 2020.","url":"https://www.cybereason.com/blog/a-bazar-of-tricks-following-team9s-development-cycles"},{"source_name":"NCC Group Team9 June 2020","description":"Pantazopoulos, N. (2020, June 2). In-depth analysis of the new Team9 malware family. Retrieved December 1, 2020.","url":"https://research.nccgroup.com/2020/06/02/in-depth-analysis-of-the-new-team9-malware-family/"}]},{"id":"S0554","name":"Egregor","url":"https://attack.mitre.org/software/S0554","kind":"malware","description":"[Egregor](https://attack.mitre.org/software/S0554) contains functionality to query the local/system time.(Citation: JoeSecurity Egregor 2020)","relationship_id":"relationship--4467fb1b-60fe-4e13-a32a-8c1f60a66782","references":[{"source_name":"JoeSecurity Egregor 2020","description":"Joe Security. (n.d.). Analysis Report fasm.dll. Retrieved November 17, 2024.","url":"https://www.joesandbox.com/analysis/326673/0/pdf"}]},{"id":"S0559","name":"SUNBURST","url":"https://attack.mitre.org/software/S0559","kind":"malware","description":"[SUNBURST](https://attack.mitre.org/software/S0559) collected device `UPTIME`.(Citation: FireEye SUNBURST Backdoor December 2020)(Citation: Microsoft Analyzing Solorigate Dec 2020)","relationship_id":"relationship--544e4a14-6aae-4950-8fed-d1246a98ed06","references":[{"source_name":"FireEye SUNBURST Backdoor December 2020","description":"FireEye. (2020, December 13). Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor. Retrieved January 4, 2021.","url":"https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"},{"source_name":"Microsoft Analyzing Solorigate Dec 2020","description":"MSTIC. (2020, December 18). Analyzing Solorigate, the compromised DLL file that started a sophisticated cyberattack, and how Microsoft Defender helps protect customers . Retrieved January 5, 2021.","url":"https://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/"}]},{"id":"S0574","name":"BendyBear","url":"https://attack.mitre.org/software/S0574","kind":"malware","description":"[BendyBear](https://attack.mitre.org/software/S0574) has the ability to determine local time on a compromised host.(Citation: Unit42 BendyBear Feb 2021) ","relationship_id":"relationship--c8a023b1-b472-40fc-98be-5709180e2628","references":[{"source_name":"Unit42 BendyBear Feb 2021","description":"Harbison, M. (2021, February 9). BendyBear: Novel Chinese Shellcode Linked With Cyber Espionage Group BlackTech. Retrieved February 16, 2021.","url":"https://unit42.paloaltonetworks.com/bendybear-shellcode-blacktech/"}]},{"id":"S0586","name":"TAINTEDSCRIBE","url":"https://attack.mitre.org/software/S0586","kind":"malware","description":"[TAINTEDSCRIBE](https://attack.mitre.org/software/S0586) can execute <code>GetLocalTime</code> for time discovery.(Citation: CISA MAR-10288834-2.v1  TAINTEDSCRIBE MAY 2020)","relationship_id":"relationship--bff9fc96-0b27-4c84-ad42-dcea53b907bf","references":[{"source_name":"CISA MAR-10288834-2.v1  TAINTEDSCRIBE MAY 2020","description":"USG. (2020, May 12). MAR-10288834-2.v1 – North Korean Trojan: TAINTEDSCRIBE. Retrieved March 5, 2021.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-133b"}]},{"id":"S0588","name":"GoldMax","url":"https://attack.mitre.org/software/S0588","kind":"malware","description":"[GoldMax](https://attack.mitre.org/software/S0588) can check the current date-time value of the compromised system, comparing it to the hardcoded execution trigger and can send the current timestamp to the C2 server.(Citation: MSTIC NOBELIUM Mar 2021)(Citation: FireEye SUNSHUTTLE Mar 2021) ","relationship_id":"relationship--2ff84270-830f-4de8-b93c-4ee3a9a46781","references":[{"source_name":"MSTIC NOBELIUM Mar 2021","description":"Nafisi, R., Lelli, A. (2021, March 4). GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence. Retrieved March 8, 2021.","url":"https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/"},{"source_name":"FireEye SUNSHUTTLE Mar 2021","description":"Smith, L., Leathery, J., Read, B. (2021, March 4). New SUNSHUTTLE Second-Stage Backdoor Uncovered Targeting U.S.-Based Entity; Possible Connection to UNC2452. Retrieved March 12, 2021.","url":"https://www.fireeye.com/blog/threat-research/2021/03/sunshuttle-second-stage-backdoor-targeting-us-based-entity.html"}]},{"id":"S0596","name":"ShadowPad","url":"https://attack.mitre.org/software/S0596","kind":"malware","description":"[ShadowPad](https://attack.mitre.org/software/S0596) has collected the current date and time of the victim system.(Citation: Kaspersky ShadowPad Aug 2017)","relationship_id":"relationship--088c3553-db7f-4e97-9f32-75e483d59cba","references":[{"source_name":"Kaspersky ShadowPad Aug 2017","description":"Kaspersky Lab. (2017, August). ShadowPad: popular server management software hit in supply chain attack. Retrieved March 22, 2021.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2017/08/07172148/ShadowPad_technical_description_PDF.pdf"}]},{"id":"S0603","name":"Stuxnet","url":"https://attack.mitre.org/software/S0603","kind":"malware","description":"[Stuxnet](https://attack.mitre.org/software/S0603) collects the time and date of a system when it is infected.(Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)","relationship_id":"relationship--ce1c1257-f244-4844-8aa5-16992430f9ef","references":[{"source_name":"Nicolas Falliere, Liam O Murchu, Eric Chien February 2011","description":"Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved November 17, 2024.","url":"https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"}]},{"id":"S0608","name":"Conficker","url":"https://attack.mitre.org/software/S0608","kind":"malware","description":"[Conficker](https://attack.mitre.org/software/S0608) uses the current UTC victim system date for domain generation and connects to time servers to determine the current date.(Citation: SANS Conficker)(Citation: Trend Micro Conficker)","relationship_id":"relationship--3074f3bd-5a30-4ad2-9a2c-45b1573a454e","references":[{"source_name":"SANS Conficker","description":"Burton, K. (n.d.). The Conficker Worm. Retrieved February 18, 2021.","url":"https://web.archive.org/web/20200125132645/https://www.sans.org/security-resources/malwarefaq/conficker-worm"},{"source_name":"Trend Micro Conficker","description":"Trend Micro. (2014, March 18). Conficker. Retrieved February 18, 2021.","url":"https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/conficker"}]},{"id":"S0615","name":"SombRAT","url":"https://attack.mitre.org/software/S0615","kind":"malware","description":"[SombRAT](https://attack.mitre.org/software/S0615) can execute <code>getinfo</code>  to discover the current time on a compromised host.(Citation: BlackBerry CostaRicto November 2020)(Citation: CISA AR21-126A FIVEHANDS May 2021)","relationship_id":"relationship--14e836d1-af9e-423e-8a8d-ad2ab169667f","references":[{"source_name":"BlackBerry CostaRicto November 2020","description":"The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.","url":"https://blogs.blackberry.com/en/2020/11/the-costaricto-campaign-cyber-espionage-outsourced"},{"source_name":"CISA AR21-126A FIVEHANDS May 2021","description":"CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar21-126a"}]},{"id":"S0622","name":"AppleSeed","url":"https://attack.mitre.org/software/S0622","kind":"malware","description":"[AppleSeed](https://attack.mitre.org/software/S0622) can pull a timestamp from the victim's machine.(Citation: Malwarebytes Kimsuky June 2021)","relationship_id":"relationship--ec134ae1-153b-46bb-b5f8-d1b9ac5275df","references":[{"source_name":"Malwarebytes Kimsuky June 2021","description":"Jazi, H. (2021, June 1). Kimsuky APT continues to target South Korean government using AppleSeed backdoor. Retrieved June 10, 2021.","url":"https://blog.malwarebytes.com/threat-analysis/2021/06/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor/"}]},{"id":"S0650","name":"QakBot","url":"https://attack.mitre.org/software/S0650","kind":"malware","description":"[QakBot](https://attack.mitre.org/software/S0650) can identify the system time on a targeted host.(Citation: Kaspersky QakBot September 2021)","relationship_id":"relationship--401790f5-abf5-4523-ac98-b200d3b34a7e","references":[{"source_name":"Kaspersky QakBot September 2021","description":"Kuzmenko, A. et al. (2021, September 2). QakBot technical analysis. Retrieved September 27, 2021.","url":"https://securelist.com/qakbot-technical-analysis/103931/"}]},{"id":"S0657","name":"BLUELIGHT","url":"https://attack.mitre.org/software/S0657","kind":"malware","description":"[BLUELIGHT](https://attack.mitre.org/software/S0657) can collect the local time on a compromised host.(Citation: Volexity InkySquid BLUELIGHT August 2021)","relationship_id":"relationship--d1d27a0f-ae6d-4058-b0ad-581aaf939e4a","references":[{"source_name":"Volexity InkySquid BLUELIGHT August 2021","description":"Cash, D., Grunzweig, J., Meltzer, M., Adair, S., Lancaster, T. (2021, August 17). North Korean APT InkySquid Infects Victims Using Browser Exploits. Retrieved September 30, 2021.","url":"https://www.volexity.com/blog/2021/08/17/north-korean-apt-inkysquid-infects-victims-using-browser-exploits/"}]},{"id":"S0660","name":"Clambling","url":"https://attack.mitre.org/software/S0660","kind":"malware","description":"[Clambling](https://attack.mitre.org/software/S0660) can determine the current time.(Citation: Trend Micro DRBControl February 2020)","relationship_id":"relationship--b6f54741-1424-4a3c-b83e-1c94df063186","references":[{"source_name":"Trend Micro DRBControl February 2020","description":"Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.","url":"https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"}]},{"id":"S0673","name":"DarkWatchman","url":"https://attack.mitre.org/software/S0673","kind":"malware","description":"[DarkWatchman](https://attack.mitre.org/software/S0673) can collect time zone information and system `UPTIME`.(Citation: Prevailion DarkWatchman 2021)","relationship_id":"relationship--5113edc5-a4ee-4888-89b1-0c3353ea05da","references":[{"source_name":"Prevailion DarkWatchman 2021","description":"Smith, S., Stafford, M. (2021, December 14). DarkWatchman: A new evolution in fileless techniques. Retrieved January 10, 2022.","url":"https://web.archive.org/web/20220629230035/https://www.prevailion.com/darkwatchman-new-fileless-techniques/"}]},{"id":"S0678","name":"Torisma","url":"https://attack.mitre.org/software/S0678","kind":"malware","description":"[Torisma](https://attack.mitre.org/software/S0678) can collect the current time on a victim machine.(Citation: McAfee Lazarus Nov 2020)","relationship_id":"relationship--1a192f9a-d515-4d5c-9c52-e904bac96f61","references":[{"source_name":"McAfee Lazarus Nov 2020","description":"Beek, C. (2020, November 5). Operation North Star: Behind The Scenes. Retrieved December 20, 2021.","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/operation-north-star-behind-the-scenes/"}]},{"id":"S0690","name":"Green Lambert","url":"https://attack.mitre.org/software/S0690","kind":"malware","description":"[Green Lambert](https://attack.mitre.org/software/S0690) can collect the date and time from a compromised host.(Citation: Objective See Green Lambert for OSX Oct 2021)(Citation: Glitch-Cat Green Lambert ATTCK Oct 2021)","relationship_id":"relationship--e2250609-d3e3-4297-8564-aff8516f8dc3","references":[{"source_name":"Objective See Green Lambert for OSX Oct 2021","description":"Sandvik, Runa. (2021, October 1). Made In America: Green Lambert for OS X. Retrieved March 21, 2022.","url":"https://objective-see.com/blog/blog_0x68.html"},{"source_name":"Glitch-Cat Green Lambert ATTCK Oct 2021","description":"Sandvik, Runa. (2021, October 18). Green Lambert and ATT&CK. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20211018145402/https://www.glitch-cat.com/blog/green-lambert-and-attack"}]},{"id":"S0692","name":"SILENTTRINITY","url":"https://attack.mitre.org/software/S0692","kind":"tool","description":"[SILENTTRINITY](https://attack.mitre.org/software/S0692) can collect start time information from a compromised host.(Citation: GitHub SILENTTRINITY Modules July 2019)","relationship_id":"relationship--6316bedb-6962-4da1-8714-08b414fa7c73","references":[{"source_name":"GitHub SILENTTRINITY Modules July 2019","description":"Salvati, M. (2019, August 6). SILENTTRINITY Modules. Retrieved March 24, 2022.","url":"https://github.com/byt3bl33d3r/SILENTTRINITY/tree/master/silenttrinity/core/teamserver/modules/boo"}]},{"id":"S0694","name":"DRATzarus","url":"https://attack.mitre.org/software/S0694","kind":"malware","description":"[DRATzarus](https://attack.mitre.org/software/S0694) can use the `GetTickCount` and `GetSystemTimeAsFileTime` API calls to inspect system time.(Citation: ClearSky Lazarus Aug 2020)","relationship_id":"relationship--52516649-550a-4930-8ed1-27391aad0379","references":[{"source_name":"ClearSky Lazarus Aug 2020","description":"ClearSky Research Team. (2020, August 13). Operation 'Dream Job' Widespread North Korean Espionage Campaign. Retrieved December 20, 2021.","url":"https://www.clearskysec.com/wp-content/uploads/2020/08/Dream-Job-Campaign.pdf"}]},{"id":"S1033","name":"DCSrv","url":"https://attack.mitre.org/software/S1033","kind":"malware","description":"[DCSrv](https://attack.mitre.org/software/S1033) can compare the current time on an infected host with a configuration value to determine when to start the encryption process.(Citation: Checkpoint MosesStaff Nov 2021)","relationship_id":"relationship--5c6dfc28-fa7c-4941-a144-890a428f9951","references":[{"source_name":"Checkpoint MosesStaff Nov 2021","description":"Checkpoint Research. (2021, November 15). Uncovering MosesStaff techniques: Ideology over Money. Retrieved August 11, 2022.","url":"https://research.checkpoint.com/2021/mosesstaff-targeting-israeli-companies/"}]},{"id":"S1034","name":"StrifeWater","url":"https://attack.mitre.org/software/S1034","kind":"malware","description":"[StrifeWater](https://attack.mitre.org/software/S1034) can collect the time zone from the victim's machine.(Citation: Cybereason StrifeWater Feb 2022)","relationship_id":"relationship--8dc0845d-c807-4e30-ac26-086f086b248f","references":[{"source_name":"Cybereason StrifeWater Feb 2022","description":"Cybereason Nocturnus. (2022, February 1). StrifeWater RAT: Iranian APT Moses Staff Adds New Trojan to Ransomware Operations. Retrieved August 15, 2022.","url":"https://www.cybereason.com/blog/research/strifewater-rat-iranian-apt-moses-staff-adds-new-trojan-to-ransomware-operations"}]},{"id":"S1043","name":"ccf32","url":"https://attack.mitre.org/software/S1043","kind":"malware","description":"[ccf32](https://attack.mitre.org/software/S1043) can determine the local time on targeted machines.(Citation: Bitdefender FunnyDream Campaign November 2020)","relationship_id":"relationship--3881653b-bd16-4eba-ab35-81da1872c5c8","references":[{"source_name":"Bitdefender FunnyDream Campaign November 2020","description":"Vrabie, V. (2020, November). Dissecting a Chinese APT Targeting South Eastern Asian Government Institutions. Retrieved September 19, 2022.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"}]},{"id":"S1044","name":"FunnyDream","url":"https://attack.mitre.org/software/S1044","kind":"malware","description":"[FunnyDream](https://attack.mitre.org/software/S1044) can check system time to help determine when changes were made to specified files.(Citation: Bitdefender FunnyDream Campaign November 2020)","relationship_id":"relationship--856ebcb0-cfec-484a-a741-900bb4d7f38a","references":[{"source_name":"Bitdefender FunnyDream Campaign November 2020","description":"Vrabie, V. (2020, November). Dissecting a Chinese APT Targeting South Eastern Asian Government Institutions. Retrieved September 19, 2022.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"}]},{"id":"S1051","name":"KEYPLUG","url":"https://attack.mitre.org/software/S1051","kind":"malware","description":"[KEYPLUG](https://attack.mitre.org/software/S1051) can obtain the current tick count of an infected computer.(Citation: Mandiant APT41)","relationship_id":"relationship--0f38f2dd-e2cf-4571-bb6c-065e50412bac","references":[{"source_name":"Mandiant APT41","description":"Rufus Brown, Van Ta, Douglas Bienstock, Geoff Ackerman, John Wolfram. (2022, March 8). Does This Look Infected? A Summary of APT41 Targeting U.S. State Governments. Retrieved July 8, 2022.","url":"https://www.mandiant.com/resources/apt41-us-state-governments"}]},{"id":"S1053","name":"AvosLocker","url":"https://attack.mitre.org/software/S1053","kind":"malware","description":"[AvosLocker](https://attack.mitre.org/software/S1053) has checked the system time before and after encryption.(Citation: Malwarebytes AvosLocker Jul 2021)","relationship_id":"relationship--f2ce9aae-bb45-4018-a5f3-922b9fcdf26a","references":[{"source_name":"Malwarebytes AvosLocker Jul 2021","description":"Hasherezade. (2021, July 23). AvosLocker enters the ransomware scene, asks for partners. Retrieved January 11, 2023.","url":"https://www.malwarebytes.com/blog/threat-intelligence/2021/07/avoslocker-enters-the-ransomware-scene-asks-for-partners"}]},{"id":"S1064","name":"SVCReady","url":"https://attack.mitre.org/software/S1064","kind":"malware","description":"[SVCReady](https://attack.mitre.org/software/S1064) can collect time zone information.(Citation: HP SVCReady Jun 2022)","relationship_id":"relationship--9414386b-adbf-4117-ba5b-81a242714d83","references":[{"source_name":"HP SVCReady Jun 2022","description":"Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022.","url":"https://threatresearch.ext.hp.com/svcready-a-new-loader-reveals-itself/"}]},{"id":"S1081","name":"BADHATCH","url":"https://attack.mitre.org/software/S1081","kind":"malware","description":"[BADHATCH](https://attack.mitre.org/software/S1081) can obtain the `DATETIME` and `UPTIME` from a compromised machine.(Citation: BitDefender BADHATCH Mar 2021)  ","relationship_id":"relationship--39f8de6f-9df3-4e6b-9076-bd3464a2d5d2","references":[{"source_name":"BitDefender BADHATCH Mar 2021","description":"Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/394/Bitdefender-PR-Whitepaper-BADHATCH-creat5237-en-EN.pdf"}]},{"id":"S1087","name":"AsyncRAT","url":"https://attack.mitre.org/software/S1087","kind":"tool","description":"[AsyncRAT](https://attack.mitre.org/software/S1087) can check whether the current system hour and day of the week are within operating hours defined it its configuration.(Citation: ESET MirrorFace 2025)","relationship_id":"relationship--18787e29-05a1-49c5-9b8b-0376ba020bd7","references":[{"source_name":"ESET MirrorFace 2025","description":" Dominik Breitenbacher. (2025, March 18). Operation AkaiRyū: MirrorFace invites Europe to Expo 2025 and revives ANEL backdoor. Retrieved May 22, 2025.","url":"https://www.welivesecurity.com/en/eset-research/operation-akairyu-mirrorface-invites-europe-expo-2025-revives-anel-backdoor/"}]},{"id":"S1111","name":"DarkGate","url":"https://attack.mitre.org/software/S1111","kind":"malware","description":"[DarkGate](https://attack.mitre.org/software/S1111) creates a log file for capturing keylogging, clipboard, and related data using the victim host's current date for the filename.(Citation: Ensilo Darkgate 2018) [DarkGate](https://attack.mitre.org/software/S1111) queries victim system epoch time during execution.(Citation: Ensilo Darkgate 2018) [DarkGate](https://attack.mitre.org/software/S1111) captures system time information as part of automated profiling on initial installation.(Citation: Trellix Darkgate 2023)","relationship_id":"relationship--b19ff9ec-1a64-4401-9bbd-e3af5a13ec7f","references":[{"source_name":"Ensilo Darkgate 2018","description":"Adi Zeligson & Rotem Kerner. (2018, November 13). Enter The DarkGate - New Cryptocurrency Mining and Ransomware Campaign. Retrieved February 9, 2024.","url":"https://www.fortinet.com/blog/threat-research/enter-the-darkgate-new-cryptocurrency-mining-and-ransomware-campaign"},{"source_name":"Trellix Darkgate 2023","description":"Ernesto Fernández Provecho, Pham Duy Phuc, Ciana Driscoll & Vinoo Thomas. (2023, November 21). The Continued Evolution of the DarkGate Malware-as-a-Service. Retrieved February 9, 2024.","url":"https://www.trellix.com/blogs/research/the-continued-evolution-of-the-darkgate-malware-as-a-service/"}]},{"id":"S1134","name":"DEADWOOD","url":"https://attack.mitre.org/software/S1134","kind":"malware","description":"[DEADWOOD](https://attack.mitre.org/software/S1134) will set a timestamp value to determine when wiping functionality starts. When the timestamp is met on the system, a trigger file is created on the operating system allowing for execution to proceed. If the timestamp is in the past, the wiper will execute immediately.(Citation: SentinelOne Agrius 2021)","relationship_id":"relationship--b59cba59-e191-4a12-aa82-1a74ec59df48","references":[{"source_name":"SentinelOne Agrius 2021","description":"Amitai Ben & Shushan Ehrlich. (2021, May). From Wiper to Ransomware: The Evolution of Agrius. Retrieved May 21, 2024.","url":"https://assets.sentinelone.com/sentinellabs/evol-agrius"}]},{"id":"S1147","name":"Nightdoor","url":"https://attack.mitre.org/software/S1147","kind":"malware","description":"[Nightdoor](https://attack.mitre.org/software/S1147) can identify the system local time information.(Citation: ESET EvasivePanda 2024)","relationship_id":"relationship--8fe98ea7-6bdc-4584-8020-f6668a402a70","references":[{"source_name":"ESET EvasivePanda 2024","description":"Ahn Ho, Facundo Muñoz, & Marc-Etienne M.Léveillé. (2024, March 7). Evasive Panda leverages Monlam Festival to target Tibetans. Retrieved July 25, 2024.","url":"https://www.welivesecurity.com/en/eset-research/evasive-panda-leverages-monlam-festival-target-tibetans/"}]},{"id":"S1148","name":"Raccoon Stealer","url":"https://attack.mitre.org/software/S1148","kind":"malware","description":"[Raccoon Stealer](https://attack.mitre.org/software/S1148) gathers victim machine timezone information.(Citation: S2W Racoon 2022)(Citation: Sekoia Raccoon2 2022)","relationship_id":"relationship--5779f61c-d06b-424d-92b9-3690e5d42a42","references":[{"source_name":"Sekoia Raccoon2 2022","description":"Pierre Le Bourhis, Quentin Bourgue, & Sekoia TDR. (2022, June 29). Raccoon Stealer v2 - Part 2: In-depth analysis. Retrieved August 1, 2024.","url":"https://blog.sekoia.io/raccoon-stealer-v2-part-2-in-depth-analysis/"},{"source_name":"S2W Racoon 2022","description":"S2W TALON. (2022, June 16). Raccoon Stealer is Back with a New Version. Retrieved August 1, 2024.","url":"https://medium.com/s2wblog/raccoon-stealer-is-back-with-a-new-version-5f436e04b20d"}]},{"id":"S1159","name":"DUSTTRAP","url":"https://attack.mitre.org/software/S1159","kind":"malware","description":"[DUSTTRAP](https://attack.mitre.org/software/S1159) reads the infected system's current time and writes it to a log file during execution.(Citation: Google Cloud APT41 2024)","relationship_id":"relationship--bed5ccbe-02dd-4736-ac42-ce0cce7f6dad","references":[{"source_name":"Google Cloud APT41 2024","description":"Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/apt41-arisen-from-dust"}]},{"id":"S1178","name":"ShrinkLocker","url":"https://attack.mitre.org/software/S1178","kind":"malware","description":"[ShrinkLocker](https://attack.mitre.org/software/S1178) retrieves a system timestamp that is used in generating an encryption key.(Citation: Splunk ShrinkLocker 2024)","relationship_id":"relationship--01091a22-80ad-490b-bcc6-5bb5c8b1c9c5","references":[{"source_name":"Splunk ShrinkLocker 2024","description":"Splunk Threat Research Team , Teoderick Contreras. (2024, September 5). ShrinkLocker Malware: Abusing BitLocker to Lock Your Data. Retrieved December 7, 2024.","url":"https://www.splunk.com/en_us/blog/security/shrinklocker-malware-abusing-bitlocker-to-lock-your-data.html"}]},{"id":"S1227","name":"StarProxy","url":"https://attack.mitre.org/software/S1227","kind":"malware","description":"[StarProxy](https://attack.mitre.org/software/S1227) has utilized the windows API call `GetLocalTime()` to retrieve a SystemTime structure to generate a seed value.(Citation: Zscaler)","relationship_id":"relationship--6e9690c6-f3d0-476a-969e-9d56e12c8b95","references":[{"source_name":"Zscaler","description":"Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: ToneShell and StarProxy | P1. Retrieved July 21, 2025.","url":"https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-toneshell-and-starproxy-p1"}]},{"id":"S1228","name":"PUBLOAD","url":"https://attack.mitre.org/software/S1228","kind":"malware","description":"[PUBLOAD](https://attack.mitre.org/software/S1228) has collected the machine’s tick count through the use of `GetTickCount`.(Citation: 2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA)","relationship_id":"relationship--d579558d-586a-4d4c-a10e-9860d61c7232","references":[{"source_name":"2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA","description":"Golo Muhr, Joshua Chung. (2025, May 15). Hive0154 targeting US, Philippines, Pakistan and Taiwan in suspected espionage campaign. Retrieved August 4, 2025.","url":"https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan"}]},{"id":"S1233","name":"PAKLOG","url":"https://attack.mitre.org/software/S1233","kind":"malware","description":"[PAKLOG](https://attack.mitre.org/software/S1233) has collected a timestamp to log the precise time a key was pressed, formatted as %Y-%m-%d %H:%M:%S.(Citation: Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025)","relationship_id":"relationship--fd5f7b22-1af7-40f7-a43f-47fd6352c634","references":[{"source_name":"Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025","description":"Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: PAKLOG, CorKLOG, and SplatCloak | P2. Retrieved September 12, 2025.","url":"https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-paklog-corklog-and-splatcloak-p2"}]},{"id":"S1244","name":"Medusa Ransomware","url":"https://attack.mitre.org/software/S1244","kind":"malware","description":"[Medusa Ransomware](https://attack.mitre.org/software/S1244) has discovered device uptime through `GetTickCount()`.(Citation: Security Scorecard Medusa Ransomware January 2024)","relationship_id":"relationship--d4d8ec73-d3ac-481d-81f7-5066bf4e9579","references":[{"source_name":"Security Scorecard Medusa Ransomware January 2024","description":"Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.","url":"https://securityscorecard.com/wp-content/uploads/2024/01/deep-dive-into-medusa-ransomware.pdf"}]},{"id":"S1246","name":"BeaverTail","url":"https://attack.mitre.org/software/S1246","kind":"malware","description":"[BeaverTail](https://attack.mitre.org/software/S1246) has obtained and sent the current timestamp associated with the victim device to C2.(Citation: ESET Contagious Interview BeaverTail InvisibleFerret February 2025)","relationship_id":"relationship--73fdccb0-fbf6-4d38-b935-65bb00fd193a","references":[{"source_name":"ESET Contagious Interview BeaverTail InvisibleFerret February 2025","description":"Matej Havranek. (2025, February 20). DeceptiveDevelopment targets freelance developers. Retrieved October 17, 2025.","url":"https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/"}]},{"id":"S9001","name":"SystemBC","url":"https://attack.mitre.org/software/S9001","kind":"malware","description":"[SystemBC](https://attack.mitre.org/software/S9001) has leveraged the time of the device to create a text file with a filename that uses the function of `uniqid(time()).‘.txt`, consisting of the 10 character UNIX timestamp and 13 hexadecimal characters.(Citation: TrumanKroll_SYSTEMBCServer_Jan2024)","relationship_id":"relationship--17efbe51-6bd0-458f-98f3-f841b105d7bf","references":[{"source_name":"TrumanKroll_SYSTEMBCServer_Jan2024","description":"Truman, D. (2024, January 19). Inside the SYSTEMBC Command-and-Control Server. Retrieved June 18, 2025.","url":"https://www.kroll.com/en/publications/cyber/inside-the-systembc-malware-server"}]},{"id":"S9010","name":"GlassWorm","url":"https://attack.mitre.org/software/S9010","kind":"malware","description":"[GlassWorm](https://attack.mitre.org/software/S9010) has the ability to check the system’s time zone on the victim device.(Citation: Socket GlassWorm January 2026)","relationship_id":"relationship--1b6ef810-3d1b-400e-88ea-171618266f54","references":[{"source_name":"Socket GlassWorm January 2026","description":"Kirill Boychenko. (2026, January 31). GlassWorm Loader Hits Open VSX via Developer Account Compromise. Retrieved April 10, 2026.","url":"https://socket.dev/blog/glassworm-loader-hits-open-vsx-via-suspected-developer-account-compromise"}]},{"id":"S9020","name":"LODEINFO","url":"https://attack.mitre.org/software/S9020","kind":"malware","description":"[LODEINFO](https://attack.mitre.org/software/S9020) can capture system time to send to the C2.(Citation: Kaspersky LODEINFO Part II OCT 2022)","relationship_id":"relationship--81b91e10-b98a-4064-995b-b48aa8ccc897","references":[{"source_name":"Kaspersky LODEINFO Part II OCT 2022","description":"Ishimaru, S. (2022, October 31). APT10: Tracking down LODEINFO 2022, part II. Retrieved April 17, 2026.","url":"https://securelist.com/apt10-tracking-down-lodeinfo-2022-part-ii/107745/"}]},{"id":"S9042","name":"CanisterWorm","url":"https://attack.mitre.org/software/S9042","kind":"malware","description":"[CanisterWorm](https://attack.mitre.org/software/S9042) has checked if the target system’s time zone is “Asia/Tehran” or “Iran.”(Citation: Palo Alto TeamPCP MAR 2026)(Citation: Aikido CanisterWorm MAR 2026)","relationship_id":"relationship--290c5e81-69e8-4ca1-983e-b24e675e7f89","references":[{"source_name":"Aikido CanisterWorm MAR 2026","description":"Eriksen, C. (2026, March 22). CanisterWorm Gets Teeth: TeamPCP's Kubernetes Wiper Targets Iran. Retrieved July 27, 2026.","url":"https://www.aikido.dev/blog/teampcp-stage-payload-canisterworm-iran"},{"source_name":"Palo Alto TeamPCP MAR 2026","description":"Unit 42. (2026, March 31). Weaponizing the Protectors: TeamPCP’s Multi-Stage Supply Chain Attack on Security Infrastructure. Retrieved July 1, 2026.","url":"https://unit42.paloaltonetworks.com/teampcp-supply-chain-attacks/"}]},{"id":"S9043","name":"Mini Shai-Hulud","url":"https://attack.mitre.org/software/S9043","kind":"malware","description":"[Mini Shai-Hulud](https://attack.mitre.org/software/S9043) has queried the system timezone configuration and timezone data files to include `/etc/localtime`, and locale settings to determine the geolocation of the compromised host.(Citation: Hunt.io TeamPCP Toolkit MAY 2026)(Citation: Phoenix TeamPCP 20 MAY 2026)","relationship_id":"relationship--6308284a-ac28-4943-b15f-368da34c01aa","references":[{"source_name":"Hunt.io TeamPCP Toolkit MAY 2026","description":"Hunt.io. (2026, May 14). How TeamPCP's Python Toolkit Survives a C2 Takedown: FIRESCALE, GitHub, and the Victim's Own Account. Retrieved July 16, 2026.","url":"https://hunt.io/blog/teampcp-python-toolkit-firescale-github-c2-takedown"},{"source_name":"Phoenix TeamPCP 20 MAY 2026","description":"Webb, M. (2026, May 20). TeamPCP Wave Four: GitHub Breach via Poisoned VS Code Extension, durabletask PyPI Worm, and ~4,000 Internal Repositories Exfiltrated. Retrieved July 16, 2026.","url":"https://phoenix.security/teampcp-github-breach-durabletask-pypi-supply-chain-wave-four-2026/"}]},{"id":"S9046","name":"IOControl","url":"https://attack.mitre.org/software/S9046","kind":"malware","description":"IOCONTROL has used the `date` and `timezone` commands to gather the system date and time information.(Citation: Claroty-IOCONTROL)(Citation: Armis-IOCONTROL)","relationship_id":"relationship--c2150a18-b5ef-4c79-84ea-b6f71b33ac5b","references":[{"source_name":"Claroty-IOCONTROL","description":"Claroty Team82. (2024, December 10). Inside a New OT/IoT Cyberweapon: IOCONTROL. Retrieved September 2, 2026.","url":"https://claroty.com/team82/research/inside-a-new-ot-iot-cyber-weapon-iocontrol"},{"source_name":"Armis-IOCONTROL","description":"Michael Freeman. (2024, December 16). IOControl Malware: What's New, What's Not?. Retrieved September 2, 2026.","url":"https://www.armis.com/blog/iocontrol-malware-whats-new-whats-not/"}]},{"id":"S9050","name":"Vidar","url":"https://attack.mitre.org/software/S9050","kind":"malware","description":"[Vidar](https://attack.mitre.org/software/S9050) has used the `GetSystemTimeAsFileTime` function to retrieve the current system date and time of the victim machine.(Citation: Cyfirma_Vidar_June2024)","relationship_id":"relationship--80d83fb7-2511-43cc-833a-6be1825a41ed","references":[{"source_name":"Cyfirma_Vidar_June2024","description":"CYFIRMA. (2024, June 3). Vidar Stealer: An In-depth Analysis of an Information-Stealing Malware. Retrieved August 13, 2026.","url":"https://www.cyfirma.com/research/vidar-stealer-an-in-depth-analysis-of-an-information-stealing-malware/"}]},{"id":"S9058","name":"SIGHTGRAB","url":"https://attack.mitre.org/software/S9058","kind":"malware","description":"[SIGHTGRAB](https://attack.mitre.org/software/S9058) has gathered the compromised victims time to be used in the naming conventions of created folders.(Citation: Mandiant_UNC1549_Nov2025) ","relationship_id":"relationship--fe1e198f-8345-4301-a4a2-17c56de0fc52","references":[{"source_name":"Mandiant_UNC1549_Nov2025","description":"El-Banna, M., et al. (2025, November 17). Frontline Intelligence: Analysis of UNC1549 TTPs, Custom Tools, and Malware Targeting the Aerospace and Defense Ecosystem. Retrieved September 28, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"}]}],"actors":[{"id":"G0010","name":"Turla","url":"https://attack.mitre.org/groups/G0010","kind":"intrusion-set","description":"[Turla](https://attack.mitre.org/groups/G0010) surveys a system upon check-in to discover the system time by using the <code>net time</code> command.(Citation: Kaspersky Turla)","relationship_id":"relationship--87b74ba7-99c4-464c-86d2-1dd8c8b578b1","references":[{"source_name":"Kaspersky Turla","description":"Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.","url":"https://securelist.com/the-epic-turla-operation/65545/"}]},{"id":"G0012","name":"Darkhotel","url":"https://attack.mitre.org/groups/G0012","kind":"intrusion-set","description":"[Darkhotel](https://attack.mitre.org/groups/G0012) malware can obtain system time from a compromised host.(Citation: Lastline DarkHotel Just In Time Decryption Nov 2015)","relationship_id":"relationship--9158696f-fdc6-4869-a395-5d94c7c13d26","references":[{"source_name":"Lastline DarkHotel Just In Time Decryption Nov 2015","description":"Arunpreet Singh, Clemens Kolbitsch. (2015, November 5). Defeating Darkhotel Just-In-Time Decryption. Retrieved April 15, 2021.","url":"https://www.lastline.com/labsblog/defeating-darkhotel-just-in-time-decryption/"}]},{"id":"G0032","name":"Lazarus Group","url":"https://attack.mitre.org/groups/G0032","kind":"intrusion-set","description":"A Destover-like implant used by [Lazarus Group](https://attack.mitre.org/groups/G0032) can obtain the current system time and send it to the C2 server.(Citation: McAfee GhostSecret)","relationship_id":"relationship--d0327dce-ca02-48ba-8830-85fcc574113c","references":[{"source_name":"McAfee GhostSecret","description":"Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018.","url":"https://securingtomorrow.mcafee.com/mcafee-labs/analyzing-operation-ghostsecret-attack-seeks-to-steal-data-worldwide/"}]},{"id":"G0046","name":"FIN7","url":"https://attack.mitre.org/groups/G0046","kind":"intrusion-set","description":"[FIN7](https://attack.mitre.org/groups/G0046) has used the PowerShell script 3CF9.ps1 to execute `net time`.(Citation: BlackBerry_FIN7_April2024)  ","relationship_id":"relationship--b846a531-6945-45d6-86f1-7964645d2ef7","references":[{"source_name":"BlackBerry_FIN7_April2024","description":" The BlackBerry Research and Intelligence Team. (2024, April 17). Threat Group FIN7 Targets the U.S. Automotive Industry. Retrieved May 1, 2025.","url":"https://blogs.blackberry.com/en/2024/04/fin7-targets-the-united-states-automotive-industry"}]},{"id":"G0060","name":"BRONZE BUTLER","url":"https://attack.mitre.org/groups/G0060","kind":"intrusion-set","description":"[BRONZE BUTLER](https://attack.mitre.org/groups/G0060) has used <code>net time</code> to check the local time on a target system.(Citation: Secureworks BRONZE BUTLER Oct 2017)","relationship_id":"relationship--6c053469-7bd4-4b55-90b2-289a09aa53fa","references":[{"source_name":"Secureworks BRONZE BUTLER Oct 2017","description":"Counter Threat Unit Research Team. (2017, October 12). BRONZE BUTLER Targets Japanese Enterprises. Retrieved January 4, 2018.","url":"https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"}]},{"id":"G0082","name":"APT38","url":"https://attack.mitre.org/groups/G0082","kind":"intrusion-set","description":"[APT38](https://attack.mitre.org/groups/G0082) has run malware to discover the system time on compromised hosts.(Citation: Microsoft Sapphire Sleet APR 2026)","relationship_id":"relationship--7f6423c1-9b45-4265-a121-aae7a22b37d9","references":[{"source_name":"Microsoft Sapphire Sleet APR 2026","description":"Microsoft Threat Intelligence. (2026, April 16). Dissecting Sapphire Sleet’s macOS intrusion from lure to compromise. Retrieved September 30, 2026.","url":"https://www.microsoft.com/en-us/security/blog/2026/04/16/dissecting-sapphire-sleets-macos-intrusion-from-lure-to-compromise/"}]},{"id":"G0089","name":"The White Company","url":"https://attack.mitre.org/groups/G0089","kind":"intrusion-set","description":"[The White Company](https://attack.mitre.org/groups/G0089) has checked the current date on the victim system.(Citation: Cylance Shaheen Nov 2018)","relationship_id":"relationship--f368f221-bcd5-400d-b350-83173de26423","references":[{"source_name":"Cylance Shaheen Nov 2018","description":"Livelli, K, et al. (2018, November 12). Operation Shaheen. Retrieved May 1, 2019.","url":"https://www.cylance.com/content/dam/cylance-web/en-us/resources/knowledge-center/resource-library/reports/WhiteCompanyOperationShaheenReport.pdf?_ga=2.161661948.1943296560.1555683782-1066572390.1555511517"}]},{"id":"G0094","name":"Kimsuky","url":"https://attack.mitre.org/groups/G0094","kind":"intrusion-set","description":"[Kimsuky](https://attack.mitre.org/groups/G0094) has gathered the system time of the device using the PowerShell cmdlet `Get-Date`.(Citation: Aryaka Kimsuky July 2025)","relationship_id":"relationship--ff10ec5e-5a02-4425-be2a-5e65325a94ee","references":[{"source_name":"Aryaka Kimsuky July 2025","description":"Varadharajan Krishnasamy, Aditya K Sood. (2025, July 29). From Reconnaissance  to Control: The Operational Blueprint of Kimsuky APT  for Cyber Espionage. Retrieved April 18, 2026.","url":"https://www.aryaka.com/docs/reports/aryaka-kimsuky-apt-operational-blueprint.pdf"}]},{"id":"G0114","name":"Chimera","url":"https://attack.mitre.org/groups/G0114","kind":"intrusion-set","description":"[Chimera](https://attack.mitre.org/groups/G0114) has used <code>time /t</code> and <code>net time \\\\ip/hostname</code> for system time discovery.(Citation: NCC Group Chimera January 2021)","relationship_id":"relationship--9736ff6e-3b76-47be-a523-3be6076ce5eb","references":[{"source_name":"NCC Group Chimera January 2021","description":"Jansen, W . (2021, January 12). Abusing cloud services to fly under the radar. Retrieved September 12, 2024.","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]},{"id":"G0121","name":"Sidewinder","url":"https://attack.mitre.org/groups/G0121","kind":"intrusion-set","description":"[Sidewinder](https://attack.mitre.org/groups/G0121) has used tools to obtain the current system time.(Citation: ATT Sidewinder January 2021)","relationship_id":"relationship--10cf6efc-6415-4a80-834a-565057e76474","references":[{"source_name":"ATT Sidewinder January 2021","description":"Hegel, T. (2021, January 13). A Global Perspective of the SideWinder APT. Retrieved January 27, 2021.","url":"https://cdn-cybersecurity.att.com/docs/global-perspective-of-the-sidewinder-apt.pdf"}]},{"id":"G0126","name":"Higaisa","url":"https://attack.mitre.org/groups/G0126","kind":"intrusion-set","description":"[Higaisa](https://attack.mitre.org/groups/G0126) used a function to gather the current time.(Citation: Zscaler Higaisa 2020)","relationship_id":"relationship--4113afe0-e84a-44ba-9180-3033de06d72e","references":[{"source_name":"Zscaler Higaisa 2020","description":"Singh, S. Singh, A. (2020, June 11). The Return on the Higaisa APT. Retrieved March 2, 2021.","url":"https://www.zscaler.com/blogs/security-research/return-higaisa-apt"}]},{"id":"G0128","name":"ZIRCONIUM","url":"https://attack.mitre.org/groups/G0128","kind":"intrusion-set","description":"[ZIRCONIUM](https://attack.mitre.org/groups/G0128) has used a tool to capture the time on a compromised host in order to register it with C2.(Citation: Zscaler APT31 Covid-19 October 2020)","relationship_id":"relationship--576c98f3-5753-4242-a5e3-7c0f769c27a1","references":[{"source_name":"Zscaler APT31 Covid-19 October 2020","description":"Singh, S. and Antil, S. (2020, October 27). APT-31 Leverages COVID-19 Vaccine Theme and Abuses Legitimate Online Services. Retrieved March 24, 2021.","url":"https://www.zscaler.com/blogs/security-research/apt-31-leverages-covid-19-vaccine-theme-and-abuses-legitimate-online"}]},{"id":"G1012","name":"CURIUM","url":"https://attack.mitre.org/groups/G1012","kind":"intrusion-set","description":"[CURIUM](https://attack.mitre.org/groups/G1012) deployed mechanisms to check system time information following strategic website compromise attacks.(Citation: PWC Yellow Liderc 2023)","relationship_id":"relationship--83c913fb-b9e4-4468-b3e2-976d59e32e9c","references":[{"source_name":"PWC Yellow Liderc 2023","description":"PwC Threat Intelligence. (2023, October 25). Yellow Liderc ships its scripts and delivers IMAPLoader malware. Retrieved August 14, 2024.","url":"https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/yellow-liderc-ships-its-scripts-delivers-imaploader-malware.html"}]},{"id":"G1017","name":"Volt Typhoon","url":"https://attack.mitre.org/groups/G1017","kind":"intrusion-set","description":"\n[Volt Typhoon](https://attack.mitre.org/groups/G1017) has obtained the victim's system timezone.(Citation: CISA AA24-038A PRC Critical Infrastructure February 2024)","relationship_id":"relationship--3e0fc6a8-83df-41da-ac13-0e37e4cfe89f","references":[{"source_name":"CISA AA24-038A PRC Critical Infrastructure February 2024","description":"CISA et al.. (2024, February 7). PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure. Retrieved May 15, 2024.","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"}]},{"id":"G1048","name":"UNC3886","url":"https://attack.mitre.org/groups/G1048","kind":"intrusion-set","description":"[UNC3886](https://attack.mitre.org/groups/G1048) has used installation scripts to collect the system time on targeted ESXi hosts.(Citation: Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023)","relationship_id":"relationship--be91925a-6d23-4d1d-a2e6-862ff823e010","references":[{"source_name":"Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023","description":"Alexander Marvi, Brad Slaybaugh, Ron Craft, and Rufus Brown. (2023, June 13). VMware ESXi Zero-Day Used by Chinese Espionage Actor to Perform Privileged Guest Operations on Compromised Hypervisors. Retrieved March 26, 2025.","url":"https://cloud.google.com/blog/topics/threat-intelligence/vmware-esxi-zero-day-bypass/"}]}],"mitigations":[],"candidates":[{"id":"1d5711d6-655c-4a47-ae9c-6503c74fa877","name":"System Time Discovery - PowerShell","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1124/T1124.yaml","description":"Identify the system time via PowerShell. Upon execution, the system time will be displayed.\n","inputs":{},"dependencies":[],"source_definition_sha256":"6665beecece77c1b0b218496e521f29aaf70ad66bad2f6b486aadc97d90de33a"},{"id":"20aba24b-e61f-4b26-b4ce-4784f763ca20","name":"System Time Discovery","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1124/T1124.yaml","description":"Identify the system time. Upon execution, the local computer system time and timezone will be displayed.\n","inputs":{"computer_name":{"description":"computer name to query","type":"string","default":"localhost"}},"dependencies":[],"source_definition_sha256":"c257fe0f3ece6563b22152e81feb9ecd53432b4d31863d41941b9f9ff81898ab"},{"id":"25c5d1f1-a24b-494a-a6c5-5f50a1ae7f47","name":"Discover System Time Zone via Registry","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1124/T1124.yaml","description":"Identify the Operating System Time Zone via registry with the reg.exe command.\nUpon execution, the system Time Zone will be shown.\n","inputs":{},"dependencies":[],"source_definition_sha256":"dde8150d9d3d5889b177a139a727c1cd63a7af4c5ff48cfd5a46b479cd4bb1d0"},{"id":"53ead5db-7098-4111-bb3f-563be390e72e","name":"System Time with Windows time Command","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1124/T1124.yaml","description":"Displays the current system time via the Windows builtin time command: https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/time\nRecently observed in use in the wild during an incident involving Ursnif malware:\nhttps://github.com/The-DFIR-Report/Sigma-Rules/blob/dc72f0b557fc63347379be0a33439788256761c8/rules/windows/process_creation/proc_creation_win_system_time_lookup.yml\nhttps://thedfirreport.com/2023/01/09/unwrapping-ursnifs-gifts/\n","inputs":{},"dependencies":[],"source_definition_sha256":"562d0b0ceb501ae0e3581d88bde27838484b2aecde91b492f40ab0f17b58849f"},{"id":"d5d5a6b0-0f92-42d8-985d-47aafa2dd4db","name":"System Time Discovery W32tm as a Delay","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1124/T1124.yaml","description":"identifies DCRat delay time tactics using w32tm.\nhttps://research.splunk.com/endpoint/b2cc69e7-11ba-42dc-a269-59c069a48870/\nhttps://blogs.blackberry.com/en/2022/05/dirty-deeds-done-dirt-cheap-russian-rat-offers-backdoor-bargains\n","inputs":{},"dependencies":[],"source_definition_sha256":"56e101919edef5ea400b8f813036fa5ccd38a5d0bd37e5f317d1b566571d971b"},{"id":"f449c933-0891-407f-821e-7916a21a1a6f","name":"System Time Discovery in FreeBSD/macOS","platforms":["linux","macos"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1124/T1124.yaml","description":"Identify system time. Upon execution, the local computer system time and timezone will be displayed. \n","inputs":{},"dependencies":[],"source_definition_sha256":"66ccd6d0f072519f6cbb857e7f8b3b429a0623675edb334f1c4b7d1270683b2d"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1059.008":"/ttp-simulation/techniques/enterprise/T1059.008/","T1053":"/ttp-simulation/techniques/enterprise/T1053/","T1614":"/ttp-simulation/techniques/enterprise/T1614/","T1124":"/ttp-simulation/techniques/enterprise/T1124/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1124","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0039","collector":"illustrative-lab-collector","observation":{"process_id":4200,"path":"C:\\Lab\\demo.txt","action":"create","size_bytes":64}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0061","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","attribute":"content_hash","before":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","after":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0016","collector":"illustrative-lab-collector","observation":{"process_id":4200,"image_loaded":"C:\\Lab\\demo.dll","signed":false,"action":"load"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0021","collector":"illustrative-lab-collector","observation":{"process_id":4200,"api":"CreateFileW","path":"C:\\Lab\\demo.txt","result":"success"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0035","collector":"illustrative-lab-collector","observation":{"source_process_id":4200,"target_process_id":4300,"granted_access":"0x1000","action":"open_process"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0034","collector":"illustrative-lab-collector","observation":{"process_id":4200,"image":"/usr/bin/sleep","owner_uid":1000,"started_at":"2026-09-27T11:59:00Z"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0001","collector":"illustrative-lab-collector","observation":{"task_name":"LabDailyCheck","action":"create","principal":"lab-user","schedule":"daily","program":"lab-check.exe"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0005","collector":"illustrative-lab-collector","observation":{"task_name":"LabDailyCheck","enabled":true,"principal":"lab-user","last_observed":"2026-09-27T12:00:00Z"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0002","collector":"illustrative-lab-collector","observation":{"account":"analyst@example.test","application":"lab-portal","result":"failure","reason":"invalid_credential","source_ip":"192.0.2.10"}}]}}