T1547.003 — Time Providers

Tactics: Persistence, Privilege Escalation · Platforms: Windows

Adversaries may abuse time providers to execute DLLs when the system boots. The Windows Time service (W32Time) enables time synchronization across and within domains. W32Time time providers are responsible for retrieving time stamps from hardware/network resources and outputting these values to…

Sub-technique of Boot or Logon Autostart Execution (T1547).

Sigma detection rules (1)

T1547.003 Boot or Logon Autostart Execution: Time Providers

title: "T1547.003 Boot or Logon Autostart Execution: Time Providers"
id: d950260d-0a12-4ffb-a4a2-3b064462559d
description: 'Detect Abuse of Windows Time Providers for Persistence. (Data Component: Windows Registry Key Modification; baseline tier: windows-eventid.) Tune using: RegistryPathScope, UserContext, TimeWindow, DllPathEntropyThreshold.'
references:
  - https://attack.mitre.org/techniques/T1547/003
author: Shahrukh Khan
date: 2026-04-11
license: MIT
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1547.003

logsource:
  category: registry_set
  product: windows
  service: sysmon

detection:
  selection:
    EventID:
      - '13'
      - '14'
    TargetObject|contains: '\Services\W32Time\TimeProviders\'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  condition: selection and not filter_system_account

falsepositives:
  - Legitimate time synchronization software registering a new time provider.

level: medium

Related sub-techniques

Explore