Detect System Time Discovery in Microsoft Sentinel
Adversaries may gather the system time and/or time zone settings from a local or remote system. System time is commonly queried to support time-bomb payloads (activating only after a preset date), sandbox evasion (detecting analysis environments via uptime or timestamp checks), encryption key generation seeded with timestamps, and victim targeting based on locale inference from timezone. Common methods include net time, w32tm /tz, GetSystemTime(), GetTickCount(), timedatectl, systemsetup -gettimezone, and ESXi-specific commands like esxcli system clock get. Malware families including Shamoon, ShrinkLocker, EvilBunny, Zebrocy, and Taidoor have all used system time queries for these purposes.
MITRE ATT&CK
- Tactic
- Discovery
- Technique
- T1124 System Time Discovery
- Canonical reference
- https://attack.mitre.org/techniques/T1124/
KQL Detection Query
let TimeDiscoveryCmds = dynamic([
"net time", "w32tm", "GetTickCount", "GetSystemTime", "GetLocalTime",
"NtQuerySystemTime", "timeIntervalSinceNow", "systemsetup -gettimezone",
"systemsetup -getnetworktimeserver", "timedatectl", "show clock",
"esxcli system clock", "clock detail"
]);
let TimeDiscoveryBinaries = dynamic([
"net.exe", "net1.exe", "w32tm.exe", "systemsetup", "timedatectl"
]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where (
(FileName in~ (TimeDiscoveryBinaries) and ProcessCommandLine has_any (TimeDiscoveryCmds))
or (FileName =~ "net.exe" and ProcessCommandLine has "time")
or (FileName =~ "net1.exe" and ProcessCommandLine has "time")
or (FileName =~ "w32tm.exe")
or (ProcessCommandLine has "w32tm" and ProcessCommandLine has_any ("/tz", "/query", "/stripchart"))
or (ProcessCommandLine has "net" and ProcessCommandLine has "time" and ProcessCommandLine has "\\\\") // remote time query
)
| extend IsRemoteTimeQuery = ProcessCommandLine has "\\\\" // net time \\hostname pattern
| extend IsTimezoneQuery = ProcessCommandLine has_any ("/tz", "timezone", "gettimezone")
| extend IsUptimeQuery = ProcessCommandLine has_any ("GetTickCount", "uptime", "/stripchart")
| extend SuspiciousParent = InitiatingProcessFileName in~ (
"powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe",
"mshta.exe", "cmd.exe", "regsvr32.exe", "rundll32.exe",
"svchost.exe", "explorer.exe"
)
| extend SuspicionScore = toint(IsRemoteTimeQuery) + toint(IsTimezoneQuery) + toint(IsUptimeQuery) + toint(SuspiciousParent)
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine,
IsRemoteTimeQuery, IsTimezoneQuery, IsUptimeQuery, SuspiciousParent, SuspicionScore
| sort by Timestamp descDetects system time and timezone discovery commands using Microsoft Defender for Endpoint DeviceProcessEvents. Covers net time (local and remote), w32tm queries, and timezone enumeration. Enriches each event with context flags for remote time queries (net time \\hostname), timezone queries, uptime checks, and suspicious parent processes. A suspicion score aggregates these indicators to help analysts prioritize — isolated time checks score low, but time discovery launched by scripting engines or LOLBins score higher.
Data Sources
Required Tables
False Positives & Tuning
- NTP monitoring tools and network management platforms (SolarWinds, PRTG, Nagios) that routinely query system time for drift detection
- IT automation scripts (Ansible, PowerShell DSC, SCCM) that check system time before applying scheduled changes or patches
- Software installations and license managers that validate the system clock before activating features or checking certificate expiry
- Backup and replication agents that synchronize timestamps across systems or verify time consistency before initiating jobs
- Security tools and SIEMs that query w32tm for time-sync audit compliance checks
Other platforms for T1124
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Local System Time Query via net time
Expected signal: Sysmon Event ID 1: Process Create with Image=C:\Windows\System32\net.exe, CommandLine='net time'. Security Event ID 4688 (if command line auditing enabled). Parent process will be cmd.exe or the test runner.
- Test 2Timezone and Time Source Discovery via w32tm
Expected signal: Sysmon Event ID 1: Two Process Create events — w32tm.exe with CommandLine 'w32tm /tz' and 'w32tm /query /status'. Security Event ID 4688 for each invocation if audit process creation is enabled.
- Test 3Remote System Time Discovery via net time with hostname
Expected signal: Sysmon Event ID 1: Process Create with Image=net.exe, CommandLine containing 'net time \\<hostname>'. Sysmon Event ID 3: Network connection to the target host on port 445 (SMB). Security Event ID 4688 if audit policy is configured.
- Test 4System Time Discovery via PowerShell (Scripted Discovery Simulation)
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe and CommandLine containing '[DateTime]::UtcNow', '[Environment]::TickCount', and '[System.TimeZoneInfo]'. PowerShell ScriptBlock Logging Event ID 4104 captures the full script. Sysmon Event ID 11: File Create for df00tech-time.txt in %TEMP%.
References (10)
- https://attack.mitre.org/techniques/T1124/
- https://technet.microsoft.com/windows-server-docs/identity/ad-ds/get-started/windows-time-service/windows-time-service-tools-and-settings
- https://msdn.microsoft.com/ms724961.aspx
- https://any.run/cybersecurity-blog/time-bombs-malware-with-delayed-execution/
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceprocessevents-table
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1124/T1124.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_net_time.yml
- https://www.picussecurity.com/resource/virtualization/sandbox-evasion-how-attackers-avoid-malware-analysis
- https://unit42.paloaltonetworks.com/shamoon-3-targets-oil-gas-organization/
- https://www.welivesecurity.com/2022/01/25/watering-hole-deploys-new-macos-malware-dazzlespy-asia/
Unlock Pro Content
Get the full detection package for T1124 including response playbook, investigation guide, and atomic red team tests.