Automation · API / MCP 中文

Technique note · T1124

System Time Discovery

An adversary may gather the system time and/or time zone settings from a local or remote system. The system time is set and stored by services, such as the Windows Time Service on Windows or <code>systemsetup</code> on macOS. These time settings may also be synchronized between systems and services in an enterprise network, typically accomplished with a network time server within a domain. System time information may be gathered in a number of ways, such as with Net on Windows by performing <code>net time \\hostname</code> to gather the system time on a remote system. The victim's time zone may also be inferred from the current system time or gathered by using <code>w32tm /tz</code>. In addition, adversaries can discover device uptime through functions such as <code>GetTickCount()</code> to determine how long it has been since the system booted up. On network devices, Network Device CLI commands such as `show clock detail` can be used to see the current time configuration. On ESXi servers, `esxcli system clock get` can be used for the same purpose. In addition, system calls – such as <code>time()</code> – have been used to collect the current time on Linux devices. On macOS systems, adversaries may use commands such as <code>systemsetup -gettimezone</code> or <code>timeIntervalSinceNow</code> to gather current time zone information or current date and time. This information could be useful for performing other techniques, such as executing a file with a Scheduled Task/Job, or to discover locality information based on time zone to assist in victim targeting (i.e. System Location Discovery). Adversaries may also use knowledge of system time as part of a time bomb, or delaying execution until a specified date/time.

ATT&CK T1124 platforms — Status Active Version 20.1

An adversary may gather the system time and/or time zone settings from a local or remote system. The system time is set and stored by services, such as the Windows Time Service on Windows or <code>systemsetup</code> on macOS.123 These time settings may also be synchronized between systems and services in an enterprise network, typically accomplished with a network time server within a domain.45 System time information may be gathered in a number of ways, such as with Net on Windows by performing <code>net time \\hostname</code> to gather the system time on a remote system. The victim's time zone may also be inferred from the current system time or gathered by using <code>w32tm /tz</code>.6 In addition, adversaries can discover device uptime through functions such as <code>GetTickCount()</code> to determine how long it has been since the system booted up.7 On network devices, Network Device CLI commands such as `show clock detail` can be used to see the current time configuration.8 On ESXi servers, `esxcli system clock get` can be used for the same purpose. In addition, system calls – such as <code>time()</code> – have been used to collect the current time on Linux devices.9 On macOS systems, adversaries may use commands such as <code>systemsetup -gettimezone</code> or <code>timeIntervalSinceNow</code> to gather current time zone information or current date and time.1011 This information could be useful for performing other techniques, such as executing a file with a Scheduled Task/Job12, or to discover locality information based on time zone to assist in victim targeting (i.e. System Location Discovery). Adversaries may also use knowledge of system time as part of a time bomb, or delaying execution until a specified date/time.13

  1. MSDN System Time
  2. Technet Windows Time Service
  3. systemsetup mac time
  4. Mac Time Sync
  5. linux system time
  6. Technet Windows Time Service
  7. Virtualization/Sandbox Evasion
  8. show_clock_detail_cisco_cmd
  9. MAGNET GOBLIN
  10. System Information Discovery Technique
  11. ESET DazzleSpy Jan 2022
  12. RSA EU12 They're Inside
  13. AnyRun TimeBomb

Groups using this technique

GroupNameCountry
grp_g0012DarkhotelSouth Korea
grp_g0128ZIRCONIUM—
grp_g0089The White Company—
grp_g0032Lazarus GroupDPRK
grp_g0114ChimeraChina
grp_g1048UNC3886—
grp_g0126Higaisa—
grp_g1012CURIUMIran
grp_g1017Volt Typhoon—
grp_g0082APT38DPRK
grp_g0046FIN7—
grp_g0010TurlaRussia
grp_g0094KimsukyDPRK
grp_g0060BRONZE BUTLER—
grp_g0121SidewinderIndia

Claims

No public claim points at this technique yet.

Auto-ingested and not human-reviewed; confidence and validity read by citation.