Use of W32tm as Timer — Sigma Rule

Rule metadata and linked tags

Author: frack113. Source status: test; severity: high. Source dates: 2022-09-25 / not supplied.

{
  "category": "process_creation",
  "product": "windows"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 748d765395aef0ecf5236aa776cc5826896edda957cb5cfefd1db0eb16a8d22f

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Use of W32tm as Timer
id: 6da2c9f5-7c53-401b-aacb-92c040ce1215
status: test
description: When configured with suitable command line arguments, w32tm can act as a delay mechanism
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/d0dad62dbcae9c60c519368e82c196a3db577055/atomics/T1124/T1124.md
    - https://blogs.blackberry.com/en/2022/05/dirty-deeds-done-dirt-cheap-russian-rat-offers-backdoor-bargains
author: frack113
date: 2022-09-25
tags:
    - attack.discovery
    - attack.t1124
logsource:
    category: process_creation
    product: windows
detection:
    selection_w32tm:
        - Image|endswith: '\w32tm.exe'
        - OriginalFileName: 'w32time.dll'
    selection_cmd:
        CommandLine|contains|all:
            - '/stripchart'
            - '/computer:'
            - '/period:'
            - '/dataonly'
            - '/samples:'
    condition: all of selection_*
falsepositives:
    - Legitimate use
level: high

Original YAML and metadata in JSON

False positives

• Legitimate use

Source references

• https://github.com/redcanaryco/atomic-red-team/blob/d0dad62dbcae9c60c519368e82c196a3db577055/atomics/T1124/T1124.md
• https://blogs.blackberry.com/en/2022/05/dirty-deeds-done-dirt-cheap-russian-rat-offers-backdoor-bargains