T1124

System Time Discovery

Discovery Last updated:

Adversaries may gather the system time and/or time zone settings from a local or remote system. System time is commonly queried to support time-bomb payloads (activating only after a preset date), sandbox evasion (detecting analysis environments via uptime or timestamp checks), encryption key generation seeded with timestamps, and victim targeting based on locale inference from timezone. Common methods include net time, w32tm /tz, GetSystemTime(), GetTickCount(), timedatectl, systemsetup -gettimezone, and ESXi-specific commands like esxcli system clock get. Malware families including Shamoon, ShrinkLocker, EvilBunny, Zebrocy, and Taidoor have all used system time queries for these purposes.

What is T1124 System Time Discovery?

System Time Discovery (T1124) maps to the Discovery tactic — the adversary is trying to figure out your environment in MITRE ATT&CK.

This page provides production-ready detection logic for System Time Discovery, covering the data sources and telemetry it touches: Process: Process Creation, Command: Command Execution, Microsoft Defender for Endpoint. The queries below are rated low severity at low confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Discovery
Technique
T1124 System Time Discovery
Canonical reference
https://attack.mitre.org/techniques/T1124/
Microsoft Sentinel / Defender
kusto 
let TimeDiscoveryCmds = dynamic([
  "net time", "w32tm", "GetTickCount", "GetSystemTime", "GetLocalTime",
  "NtQuerySystemTime", "timeIntervalSinceNow", "systemsetup -gettimezone",
  "systemsetup -getnetworktimeserver", "timedatectl", "show clock",
  "esxcli system clock", "clock detail"
]);
let TimeDiscoveryBinaries = dynamic([
  "net.exe", "net1.exe", "w32tm.exe", "systemsetup", "timedatectl"
]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where (
    (FileName in~ (TimeDiscoveryBinaries) and ProcessCommandLine has_any (TimeDiscoveryCmds))
    or (FileName =~ "net.exe" and ProcessCommandLine has "time")
    or (FileName =~ "net1.exe" and ProcessCommandLine has "time")
    or (FileName =~ "w32tm.exe")
    or (ProcessCommandLine has "w32tm" and ProcessCommandLine has_any ("/tz", "/query", "/stripchart"))
    or (ProcessCommandLine has "net" and ProcessCommandLine has "time" and ProcessCommandLine has "\\\\")  // remote time query
)
| extend IsRemoteTimeQuery = ProcessCommandLine has "\\\\"  // net time \\hostname pattern
| extend IsTimezoneQuery = ProcessCommandLine has_any ("/tz", "timezone", "gettimezone")
| extend IsUptimeQuery = ProcessCommandLine has_any ("GetTickCount", "uptime", "/stripchart")
| extend SuspiciousParent = InitiatingProcessFileName in~ (
    "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe",
    "mshta.exe", "cmd.exe", "regsvr32.exe", "rundll32.exe",
    "svchost.exe", "explorer.exe"
  )
| extend SuspicionScore = toint(IsRemoteTimeQuery) + toint(IsTimezoneQuery) + toint(IsUptimeQuery) + toint(SuspiciousParent)
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine,
         IsRemoteTimeQuery, IsTimezoneQuery, IsUptimeQuery, SuspiciousParent, SuspicionScore
| sort by Timestamp desc

Detects system time and timezone discovery commands using Microsoft Defender for Endpoint DeviceProcessEvents. Covers net time (local and remote), w32tm queries, and timezone enumeration. Enriches each event with context flags for remote time queries (net time \\hostname), timezone queries, uptime checks, and suspicious parent processes. A suspicion score aggregates these indicators to help analysts prioritize — isolated time checks score low, but time discovery launched by scripting engines or LOLBins score higher.

low severity low confidence

Data Sources

Process: Process Creation Command: Command Execution Microsoft Defender for Endpoint

Required Tables

DeviceProcessEvents

False Positives

  • NTP monitoring tools and network management platforms (SolarWinds, PRTG, Nagios) that routinely query system time for drift detection
  • IT automation scripts (Ansible, PowerShell DSC, SCCM) that check system time before applying scheduled changes or patches
  • Software installations and license managers that validate the system clock before activating features or checking certificate expiry
  • Backup and replication agents that synchronize timestamps across systems or verify time consistency before initiating jobs
  • Security tools and SIEMs that query w32tm for time-sync audit compliance checks

Sigma rule & cross-platform mapping

The detection logic for System Time Discovery (T1124) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1124 Sigma rules on detection.fyi

Platform-specific guides for T1124

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-04-18 Research depth: deep
References (8)

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Local System Time Query via net time

    Expected signal: Sysmon Event ID 1: Process Create with Image=C:\Windows\System32\net.exe, CommandLine='net time'. Security Event ID 4688 (if command line auditing enabled). Parent process will be cmd.exe or the test runner.

  2. Test 2Timezone and Time Source Discovery via w32tm

    Expected signal: Sysmon Event ID 1: Two Process Create events — w32tm.exe with CommandLine 'w32tm /tz' and 'w32tm /query /status'. Security Event ID 4688 for each invocation if audit process creation is enabled.

  3. Test 3Remote System Time Discovery via net time with hostname

    Expected signal: Sysmon Event ID 1: Process Create with Image=net.exe, CommandLine containing 'net time \\<hostname>'. Sysmon Event ID 3: Network connection to the target host on port 445 (SMB). Security Event ID 4688 if audit policy is configured.

  4. Test 4System Time Discovery via PowerShell (Scripted Discovery Simulation)

    Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe and CommandLine containing '[DateTime]::UtcNow', '[Environment]::TickCount', and '[System.TimeZoneInfo]'. PowerShell ScriptBlock Logging Event ID 4104 captures the full script. Sysmon Event ID 11: File Create for df00tech-time.txt in %TEMP%.

Response Playbook

Triage

  1. Identify the exact command executed — distinguish between a local time query (net time, w32tm /tz) and a remote system time query (net time \\hostname). Remote queries are significantly more suspicious as they indicate reconnaissance of other hosts.
  2. Examine the parent process — if the time discovery command was spawned by powershell.exe, wscript.exe, cscript.exe, mshta.exe, or an Office process, escalate immediately. Legitimate admin tools do not typically call net time from scripting engines.
  3. Assess the execution context — was this run by a service account, an interactive user, or via a scheduled task? Service accounts querying system time interactively on workstations are anomalous.
  4. Check for temporal clustering — search for other discovery commands within a 5-minute window around this event. T1124 rarely occurs in isolation; look for co-occurring T1033 (whoami), T1082 (systeminfo), T1016 (ipconfig), T1049 (netstat). A cluster of discovery commands is a strong compromise indicator.
  5. Review the device history — is this the first time this command ran on this host? Use DeviceProcessEvents with a 30-day lookback on the same device to establish baseline frequency.
  6. If the process is w32tm.exe with /stripchart against an external NTP server not in your approved server list, this may indicate NTP-based C2 or sandbox evasion probing.

Containment

  1. System time discovery alone is low-severity and does not warrant immediate containment — containment decisions should be driven by correlated activity (C2 beaconing, lateral movement, credential access) detected in the same timeframe.
  2. If time discovery is part of a confirmed intrusion chain: isolate the endpoint via EDR network isolation or VLAN reassignment to prevent lateral movement while investigation proceeds.
  3. If the querying account shows signs of compromise: disable the account in Active Directory, invalidate Kerberos tickets (krbtgt rotation if domain-wide compromise is suspected), and revoke any active sessions.
  4. If malware performing time-bomb checks is identified: collect a memory image before remediation to preserve the time threshold logic and payload for analysis.
  5. Block suspicious parent processes (wscript.exe, mshta.exe) from executing child processes via AppLocker or Windows Defender Application Control (WDAC) rules if not already enforced.

Evidence Collection

  1. Process Creation Events — Sysmon Event ID 1 or Security Event ID 4688 (requires process command line auditing via GPO: Computer Configuration > Audit Policy > Audit Process Creation + Command Line) for the full command line of the time discovery process.
  2. Parent Process Chain — trace the full process tree upward from net.exe or w32tm.exe using Sysmon ProcessGuid correlations or EDR pivot to understand what launched the time query.
  3. Security Event ID 4688 with command line data — if Sysmon is not deployed, ensure 4688 includes ProcessCommandLine (enabled via: auditpol /set /subcategory:'Process Creation' /success:enable and registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit\ProcessCreationIncludeCmdLine_Enabled = 1).
  4. Network Events — if net time targeted a remote host, capture the SMB connection via Sysmon Event ID 3 or firewall logs to identify which remote host was queried.
  5. Prefetch Files — C:\Windows\Prefetch\NET.EXE-*.pf and W32TM.EXE-*.pf contain execution timestamps and can confirm or deny prior execution history on the system.
  6. PowerShell ScriptBlock Logging (Event ID 4104) — if the time discovery was invoked from a PowerShell parent, the full script content including the net time call will be logged here.
  7. Timeline of co-occurring process creation events (Sysmon Event ID 1) within ±5 minutes on the same host to identify the broader discovery phase activity.

Escalation Criteria

  • ! Time discovery command spawned directly by a scripting engine (powershell.exe, wscript.exe, cscript.exe, mshta.exe) or Office application — indicates scripted reconnaissance rather than manual admin activity.
  • ! Remote system time query (net time \\<hostname>) targeting domain controllers, file servers, or other high-value infrastructure — indicates adversary mapping network topology.
  • ! Time discovery occurring within 5 minutes of other discovery commands (whoami, ipconfig, systeminfo, net user, net group, nltest) — indicates an active discovery phase consistent with post-exploitation.
  • ! Execution under a service account, SYSTEM context, or an account with no history of interactive logon — strongly suggests automated malware behavior.
  • ! w32tm or net time executed by a process that subsequently makes outbound connections to external IPs — possible time-bomb check prior to C2 registration or payload activation.
  • ! Detection on a host where other endpoint detections (credential access, defense evasion, lateral movement) have fired within the same incident window.

Investigation Guide

Forensic Artifacts

  • > Prefetch: C:\Windows\Prefetch\NET.EXE-*.pf — confirms net.exe execution with run count and timestamps
  • > Prefetch: C:\Windows\Prefetch\W32TM.EXE-*.pf — confirms w32tm.exe execution history
  • > Registry: HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Parameters — current NTP server configuration, useful if adversary modified time sync settings
  • > Registry: HKLM\SYSTEM\CurrentControlSet\Control\TimeZoneInformation — stored timezone data that an adversary may have read via registry query
  • > Event Log: System — Event ID 37 (W32Time: time provider NtpClient cannot reach or is currently receiving invalid time data) and Event ID 1 (W32Time: time service started) for timeline context
  • > Event Log: Security — Event ID 4688 (process creation) if command line auditing is enabled; Event ID 4624/4648 to confirm logon context for the account that ran the command
  • > Sysmon Event ID 1: Process creation log with full command line for net.exe, net1.exe, w32tm.exe
  • > Sysmon Event ID 3: Network connection if net time queried a remote host (port 445 SMB to target)
  • > Windows Task Scheduler logs: Microsoft-Windows-TaskScheduler/Operational — if time discovery was triggered by a scheduled task, the task name and action will be logged here
  • > Memory: If malware is suspected, capture a full memory image — time-bomb malware stores the target date/time in memory, and strings or YARA scans may recover the threshold value

Tuning Guidance

System time discovery is extremely noisy in production environments because dozens of legitimate tools query the clock as part of normal operations. The most effective tuning strategy is to build exclusions around known-good parent processes and service accounts rather than suppressing the commands entirely. Start by identifying which monitoring agents (SolarWinds, Datadog, PRTG, Nagios), backup tools (Veeam, Commvault), and deployment systems (SCCM, Ansible) routinely run w32tm or net time — add their service accounts and parent process names to an allowlist. For the core detection, raise fidelity by requiring SuspicionScore >= 2 (e.g., time discovery from a scripting engine parent, or remote time query combined with other discovery activity). The hunting queries for co-occurring discovery techniques are more reliable than the raw time-check detection alone. On Linux/macOS environments, date and timedatectl are called so frequently by shell scripts and monitoring agents that process-level detection is impractical — focus instead on behavioral clustering: a burst of system profiling commands (id, uname, date, ifconfig, ps) within 60 seconds is far more indicative of adversary activity than any single command. For high-value server environments where net time should never be run interactively, consider alerting at SuspicionScore >= 1 instead.

Hunting Queries

Hunt for accounts or hosts with unusually high frequency of time discovery commands, or those launching time discovery from multiple different parent processes. High counts from a single account may indicate automated malware recon; multiple parent processes may indicate different malware components all performing independent time checks.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("net.exe", "net1.exe", "w32tm.exe")
| where ProcessCommandLine has "time" or FileName =~ "w32tm.exe"
| summarize
    TimeDiscoveryCount = count(),
    Commands = make_set(ProcessCommandLine),
    FirstSeen = min(Timestamp),
    LastSeen = max(Timestamp),
    UniqueParents = dcount(InitiatingProcessFileName)
  by DeviceName, AccountName
| where TimeDiscoveryCount > 5 or UniqueParents > 2
| sort by TimeDiscoveryCount desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (Image="*\\net.exe" OR Image="*\\net1.exe" OR Image="*\\w32tm.exe")
  (CommandLine="*time*" OR Image="*w32tm*")
| stats
    count as TimeDiscoveryCount,
    values(CommandLine) as Commands,
    earliest(_time) as FirstSeen,
    latest(_time) as LastSeen,
    dc(ParentImage) as UniqueParents
  by host, User
| where TimeDiscoveryCount > 5 OR UniqueParents > 2
| sort - TimeDiscoveryCount

Hunt for time discovery commands occurring within 5-minute windows alongside other discovery techniques (whoami, systeminfo, ipconfig, hostname). Co-occurring discovery commands are a hallmark of post-exploitation reconnaissance phases. This query specifically requires time discovery to be present, then looks for breadth of other discovery activity in the same window.

Hunting — KQL
kql 
let DiscoveryWindow = 5m;
let DiscoveryCommands = DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("net.exe", "net1.exe", "w32tm.exe", "whoami.exe", "ipconfig.exe", "systeminfo.exe", "nltest.exe", "hostname.exe", "quser.exe")
| where ProcessCommandLine has_any ("time", "user", "group", "config", "domain", "computer")
   or FileName in~ ("whoami.exe", "hostname.exe", "ipconfig.exe", "systeminfo.exe", "w32tm.exe")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine;
DiscoveryCommands
| where FileName in~ ("net.exe", "net1.exe", "w32tm.exe") and ProcessCommandLine has "time"
| join kind=inner (
    DiscoveryCommands
    | where FileName in~ ("whoami.exe", "systeminfo.exe", "ipconfig.exe", "hostname.exe")
  ) on DeviceName, AccountName
| where abs(datetime_diff('minute', Timestamp, Timestamp1)) <= 5
| project Timestamp, DeviceName, AccountName, TimeCmd=FileName, TimeCmdLine=ProcessCommandLine,
         CooccurCmd=FileName1, CooccurCmdLine=ProcessCommandLine1
| sort by Timestamp desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (Image="*\\net.exe" OR Image="*\\net1.exe" OR Image="*\\w32tm.exe"
   OR Image="*\\whoami.exe" OR Image="*\\systeminfo.exe" OR Image="*\\ipconfig.exe" OR Image="*\\hostname.exe")
| eval DiscoveryType=case(
    match(Image, "(net|net1)\.exe") AND match(CommandLine, "time"), "time_discovery",
    match(Image, "w32tm\.exe"), "time_discovery",
    match(Image, "whoami\.exe"), "user_discovery",
    match(Image, "systeminfo\.exe"), "sysinfo_discovery",
    match(Image, "ipconfig\.exe"), "network_discovery",
    match(Image, "hostname\.exe"), "hostname_discovery",
    true(), "other"
  )
| bin _time span=5m
| stats
    values(DiscoveryType) as TechniqueTypes,
    dc(DiscoveryType) as UniqueTypes,
    values(CommandLine) as Commands,
    count as CmdCount
  by _time, host, User
| where UniqueTypes >= 2 AND mvfind(TechniqueTypes, "time_discovery") >= 0
| sort - _time

Hunt for remote system time queries (net time \\hostname) targeting multiple distinct hosts. Adversaries performing network reconnaissance may enumerate time on several systems to map domain infrastructure, identify domain controllers (which serve time), or establish which hosts are online. Multiple unique target hostnames from a single account is a strong indicator of active reconnaissance.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("net.exe", "net1.exe")
| where ProcessCommandLine matches regex @"net(1)?\.exe.*\btime\b.*\\\\\w"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine,
         TargetHost = extract(@"\\\\([\w\-\.]+)", 1, ProcessCommandLine)
| join kind=leftouter (
    DeviceNetworkEvents
    | where Timestamp > ago(7d)
    | where RemotePort == 445
    | project NetworkTimestamp=Timestamp, DeviceName, RemoteIP, RemoteUrl
  ) on DeviceName
| where abs(datetime_diff('second', Timestamp, NetworkTimestamp)) < 30
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, TargetHost, RemoteIP
| sort by Timestamp desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (Image="*\\net.exe" OR Image="*\\net1.exe")
  CommandLine="*time*\\*"
| rex field=CommandLine "time\s+(?<TargetHost>\\\\[\w\-\.]+)"
| eval TargetHost=replace(TargetHost, "\\\\", "")
| where isnotnull(TargetHost) AND TargetHost!=""
| stats
    count as QueryCount,
    values(TargetHost) as TargetHosts,
    dc(TargetHost) as UniqueTargets,
    earliest(_time) as FirstQuery,
    latest(_time) as LastQuery
  by host, User
| where UniqueTargets > 1
| sort - UniqueTargets

Atomic Red Team Tests

Test 1 Local System Time Query via net time
windows

Queries the local system time using the built-in net time command. This is the simplest form of T1124 and simulates what malware like Epic (Turla) and Zebrocy do to collect the current timestamp from a compromised host.

Command

powershell 
net time

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=C:\Windows\System32\net.exe, CommandLine='net time'. Security Event ID 4688 (if command line auditing enabled). Parent process will be cmd.exe or the test runner.

Expected Detection

KQL: IsNetTime=true, SuspicionScore >= 1. SPL: IsNetTime=1, SuspicionScore=1. Alert fires on net.exe with 'time' in command line.

Test 2 Timezone and Time Source Discovery via w32tm
windows

Uses w32tm.exe to enumerate the system timezone and NTP configuration — a pattern used by Zebrocy and UPPERCUT to collect timezone information for victim profiling. The /tz flag retrieves timezone settings; /query /status retrieves the current NTP sync source and stratum.

Command

powershell 
w32tm /tz && w32tm /query /status

Expected Telemetry

Sysmon Event ID 1: Two Process Create events — w32tm.exe with CommandLine 'w32tm /tz' and 'w32tm /query /status'. Security Event ID 4688 for each invocation if audit process creation is enabled.

Expected Detection

KQL: IsW32tmQuery=true, IsTimezoneQuery=true for the /tz invocation. SuspicionScore >= 1 for each event. SPL: IsW32tmQuery=1, IsTimezoneQuery=1. Both events will generate alerts.

Test 3 Remote System Time Discovery via net time with hostname
windows

Queries the system time of a remote host using net time \\<target>. This simulates reconnaissance behavior used by Epic/Turla and Net (S0039) to discover time on network-accessible systems, which can reveal domain controllers (which serve time) and confirm host availability.

Command

powershell 
net time \\%COMPUTERNAME%

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=net.exe, CommandLine containing 'net time \\<hostname>'. Sysmon Event ID 3: Network connection to the target host on port 445 (SMB). Security Event ID 4688 if audit policy is configured.

Expected Detection

KQL: IsRemoteTimeQuery=true, SuspicionScore >= 2 (IsNetTime + IsRemoteTimeQuery). SPL: IsRemoteTimeQuery=1, SuspicionScore=2. The remote query variant should trigger higher-priority alerts than local time checks.

Test 4 System Time Discovery via PowerShell (Scripted Discovery Simulation)
windows

Simulates a malware script performing time discovery through PowerShell using .NET methods — the same approach used by ShrinkLocker (for encryption key seeding) and EvilBunny (for sandbox evasion via uptime checking). Uses [DateTime]::UtcNow for timestamp and [Environment]::TickCount for uptime, then writes results to a temp file simulating data staging.

Command

powershell 
powershell.exe -NoProfile -Command "$ts = [DateTime]::UtcNow; $tc = [Environment]::TickCount; $tz = [System.TimeZoneInfo]::Local.DisplayName; Write-Output ""Timestamp: $ts | TickCount: $tc | TZ: $tz"" | Out-File $env:TEMP\df00tech-time.txt"

Cleanup

powershell 
Remove-Item $env:TEMP\df00tech-time.txt -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=powershell.exe and CommandLine containing '[DateTime]::UtcNow', '[Environment]::TickCount', and '[System.TimeZoneInfo]'. PowerShell ScriptBlock Logging Event ID 4104 captures the full script. Sysmon Event ID 11: File Create for df00tech-time.txt in %TEMP%.

Expected Detection

The PowerShell-based time discovery does not directly trigger the net.exe/w32tm KQL detection, but will be caught by T1059.001 PowerShell detection rules if combined with other suspicious patterns. This test validates that analysts can correlate PowerShell-based time discovery with the process tree. The parent process (powershell.exe) launching time discovery is what elevates SuspicionScore in follow-on process chains.

Related Detections

Tactic Hub

TA0007Discovery

Related Techniques

T1033System Owner/User DiscoveryT1082System Information DiscoveryT1016System Network Configuration DiscoveryT1497Virtualization/Sandbox EvasionT1497.001System ChecksT1053Scheduled Task/JobT1614System Location DiscoveryT1059.001PowerShellT1059.003Windows Command ShellT1485Data Destruction

Same Tactic: Discovery

Popular Detections