System Time Discovery

An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network. ^[1] ^[2]

System time information may be gathered in a number of ways, such as with Net on Windows by performing net time \hostname to gather the system time on a remote system. The victim's time zone may also be inferred from the current system time or gathered by using w32tm /tz. ^[2] The information could be useful for performing other techniques, such as executing a file with a Scheduled Task/Job ^[3], or to discover locality information based on time zone to assist in victim targeting.

ID: T1124

Sub-techniques: No sub-techniques

Tactic: Discovery

Platforms: Windows

Permissions Required: User

Data Sources: API monitoring, Process command-line parameters, Process monitoring

CAPEC ID: CAPEC-295

Version: 1.1

Created: 31 May 2017

Last Modified: 15 March 2020

Version Permalink

Live Version

Procedure Examples

Name	Description
Agent Tesla	Agent Tesla can collect the timestamp from the victim’s machine.^[10]
Astaroth	Astaroth collects the timestamp from the infected machine. ^[26]
Azorult	Azorult can collect the time zone information from the system.^[23]^[24]
BRONZE BUTLER	BRONZE BUTLER has used `net time` to check the local time on a target system.^[37]
build_downer	build_downer has the ability to determine the local time to ensure malware installation only happens during the hours that the infected system is active.^[33]
Cannon	Cannon can collect the current time zone information from the victim’s machine.^[7]
Carbon	Carbon uses the command `net time \127.0.0.1` to get information the system’s time.^[17]
Epic	Epic uses the `net time` command to get the system time from the machine and collect the current date and time zone information.^[11]
EvilBunny	EvilBunny has used the API calls NtQuerySystemTime, GetSystemTimeAsFileTime, and GetTickCount to check to see if the malware is running in a sandbox.^[29]
FELIXROOT	FELIXROOT gathers the time zone information from the victim’s machine.^[14]
GravityRAT	GravityRAT can obtain the date and time of a system.^[20]
GRIFFON	GRIFFON has used a reconnaissance module that can be used to retrieve the date and time of the system.^[30]
HOPLIGHT	HOPLIGHT has been observed collecting system time from victim machines.^[27]
InvisiMole	InvisiMole gathers the local system time from the victim’s machine.^[19]
Lazarus Group	A Destover-like implant used by Lazarus Group can obtain the current system time and send it to the C2 server.^[8]
Metamorfo	Metamorfo uses JavaScript to get the system time.^[36]
MoonWind	MoonWind obtains the victim's current time.^[5]
Net	The `net time` command can be used in Net to determine the local or remote system time.^[4]
NOKKI	NOKKI can collect the current timestamp of the victim's machine.^[15]
Okrum	Okrum can obtain the date and time of the compromised system.^[31]
OopsIE	OopsIE checks to see if the system is configured with "Daylight" time and checks for a specific region to be set for the timezone.^[22]
PowerDuke	PowerDuke has commands to get the time the machine was built, the time, and the time zone.^[21]
Proxysvc	As part of the data reconnaissance phase, Proxysvc grabs the system time to send back to the control server.^[8]
RTM	RTM can obtain the victim time zone.^[18]
Shamoon	Shamoon obtains the system time and will only activate if it is greater than a preset date.^[12]^[13]
SHARPSTATS	SHARPSTATS has the ability to identify the current date and time on the compromised host.^[32]
StoneDrill	StoneDrill can obtain the current date and time of the victim machine.^[28]
T9000	T9000 gathers and beacons the system time during installation.^[6]
TajMahal	TajMahal has the ability to determine local time on a compromised host.^[34]
The White Company	The White Company has checked the current date on the victim system.^[38]
Turla	Turla surveys a system upon check-in to discover the system time by using the `net time` command.^[11]
UPPERCUT	UPPERCUT has the capability to obtain the time zone information and current timestamp of the victim’s machine.^[9]
WindTail	WindTail has the ability to generate the current date and time.^[35]
Zebrocy	Zebrocy gathers the current time zone and date information from the system.^[25]
Zeus Panda	Zeus Panda collects the current system time (UTC) and sends it back to the C2 server.^[16]

Mitigations

This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.

Detection

Command-line interface monitoring may be useful to detect instances of net.exe or other command-line utilities being used to gather system time or time zone. Methods of detecting API use for gathering this information are likely less useful due to how often they may be used by legitimate software.

System Time Discovery

Procedure Examples

Mitigations

Detection

References