Detect System Time Discovery in Google Chronicle

rule t1124_system_time_discovery {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects MITRE ATT&CK T1124 System Time Discovery via common time-querying binaries"
    mitre_attack_tactic = "Discovery"
    mitre_attack_technique = "T1124"
    severity = "LOW"
    confidence = "HIGH"
    version = "1.0"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    (
      (
        re.regex($e.principal.process.file.full_path, `(?i)(\\|/)net1?\.exe$`) and
        re.regex($e.target.process.command_line, `(?i)\btime\b`)
      ) or
      re.regex($e.target.process.file.full_path, `(?i)(\\|/)w32tm\.exe$`) or
      (
        re.regex($e.target.process.file.full_path, `(?i)(\\|/)timedatectl$`) and
        re.regex($e.target.process.command_line, `(?i)(status|show|timesync-status)`)
      ) or
      (
        re.regex($e.target.process.file.full_path, `(?i)(\\|/)systemsetup$`) and
        re.regex($e.target.process.command_line, `(?i)(-gettimezone|-getnetworktimeserver)`)
      ) or
      re.regex($e.target.process.command_line, `(?i)esxcli\s+system\s+clock`)
    )

  match:
    $e.principal.hostname over 5m

  outcome:
    $hostname = $e.principal.hostname
    $username = $e.principal.user.userid
    $process_path = $e.target.process.file.full_path
    $command_line = $e.target.process.command_line
    $parent_process = $e.principal.process.file.full_path
    $is_remote_query = if(
      re.regex($e.target.process.command_line, `(?i)net1?\.exe.*\btime\b.*\\\\`),
      "true", "false"
    )
    $is_timezone_query = if(
      re.regex($e.target.process.command_line, `(?i)(/tz|/query|timezone|gettimezone)`),
      "true", "false"
    )
    $suspicious_parent = if(
      re.regex($e.principal.process.file.full_path, `(?i)(powershell|pwsh|wscript|cscript|mshta|regsvr32|rundll32)\.exe`),
      "true", "false"
    )

  condition:
    $e
}