T1124 — System Time Discovery

Tactic: Discovery · Platforms: ESXi, Linux, macOS, Network Devices, Windows

An adversary may gather the system time and/or time zone settings from a local or remote system. The system time is set and stored by services, such as the Windows Time Service on Windows or systemsetup on macOS. These time settings may also be synchronized between systems and services in an…

Sigma detection rules (5)

T1124 System Time Discovery

title: T1124 System Time Discovery
id: b9409836-9607-4158-a729-cfa58a075e16
description: 'Detects net time/w32tm/tzutil used to discover local system time/timezone. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: TimeWindow, AllowedParents, CommandlineKeywordList, UserContextScope, ProcessPrevalenceThreshold.'
references:
  - https://attack.mitre.org/techniques/T1124
author: Shahrukh Khan
date: 2026-03-26
license: MIT
tags:
  - attack.discovery
  - attack.t1124

logsource:
  category: process_creation
  product: windows

detection:
  selection_net_time:
    Image|endswith:
      - '\net.exe'
      - '\net1.exe'
    CommandLine|contains: 'time'
  selection_w32tm:
    Image|endswith: '\w32tm.exe'
    CommandLine|contains:
      - '/tz'
      - '/query'
      - 'time.windows.com'
  selection_tzutil:
    Image|endswith: '\tzutil.exe'
    CommandLine|contains: '/g'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  condition: (1 of selection_*) and not filter_system_account

falsepositives:
  - Legitimate NTP troubleshooting.

level: medium

T1124 System Time Discovery

title: T1124 System Time Discovery
id: a16c4964-1527-4f56-9e03-a7e1332ccbab
description: 'Behavior-chain, platform-aware detection strategy for T1124 System Time Discovery. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: AuditRulesSyscalls, AllowedBinaries, TimeWindow, UserContextScope.'
references:
  - https://attack.mitre.org/techniques/T1124
author: Shahrukh Khan
date: 2026-05-06
license: MIT
tags:
  - attack.discovery
  - attack.t1124

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '/date'
      - '/timedatectl'
      - '/hwclock'

  condition: selection

falsepositives:
  - date/timedatectl/hwclock are extremely common benign commands run by scripts, cron jobs, and interactive users.

level: informational

T1124 System Time Discovery

title: T1124 System Time Discovery
id: 76784aac-5bd0-4253-996a-a95e58306879
description: 'Behavior-chain, platform-aware detection strategy for T1124 System Time Discovery. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: LaunchdPaths, TimeWindow, AllowedCallers.'
references:
  - https://attack.mitre.org/techniques/T1124
author: Shahrukh Khan
date: 2026-06-01
license: MIT
tags:
  - attack.discovery
  - attack.t1124

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith:
      - '/date'
      - '/systemsetup'
    CommandLine|contains: '-gettime'

  condition: selection

falsepositives:
  - Routine scripts and monitoring agents query system time for logging or scheduling purposes.

level: informational

T1124 System Time Discovery

title: T1124 System Time Discovery
id: f6804692-f735-4066-b317-025b18d3ab13
description: 'Behavior-chain, platform-aware detection strategy for T1124 System Time Discovery. (Data Component: Command Execution; baseline tier: fallback.) Tune using: AllowedAdminSubnets, KnownMaintenanceUsers, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1124
author: Shahrukh Khan
date: 2026-03-13
license: MIT
tags:
  - attack.discovery
  - attack.t1124

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection_date:
    type: EXECVE
    a0|endswith: '/date'
  selection_timedatectl:
    type: EXECVE
    a0|endswith: '/timedatectl'
  selection_uptime:
    type: EXECVE
    a0|endswith: '/uptime'

  condition: 1 of selection_*

falsepositives:
  - Extremely common benign activity; date, timedatectl, and uptime are invoked constantly by scripts, cron jobs, and interactive users.

level: informational

T1124 System Time Discovery

title: T1124 System Time Discovery
id: 76851e36-aace-4504-aae0-0aef4ff552bc
description: 'Behavior-chain, platform-aware detection strategy for T1124 System Time Discovery. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: MaintenanceWindow, PrivilegedAccountsAllowList, RemoteIPAllowList, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1124
author: Shahrukh Khan
date: 2026-01-25
license: MIT
tags:
  - attack.discovery
  - attack.t1124

logsource:
  category: process_creation
  product: esxi
  service: shell

detection:
  selection:
    CommandLine|contains:
      - 'esxcli system time get'
      - 'esxcli system ntp get'
      - 'date'

  condition: selection

falsepositives:
  - Extremely common administrative and scripted health-check activity; only meaningful when correlated against PrivilegedAccountsAllowList and TimeWindow tuning outside this rule, since shell.log alone cannot express those constraints.

level: informational

Explore