System Time Discovery

An adversary may gather the system time and/or time zone settings from a local or remote system. The system time is set and stored by services, such as the Windows Time Service on Windows or <code>systemsetup</code> on macOS.¹²³ These time settings may also be synchronized between systems and services in an enterprise network, typically accomplished with a network time server within a domain.⁴⁵ System time information may be gathered in a number of ways, such as with Net on Windows by performing <code>net time \\hostname</code> to gather the system time on a remote system. The victim's time zone may also be inferred from the current system time or gathered by using <code>w32tm /tz</code>.⁶ In addition, adversaries can discover device uptime through functions such as <code>GetTickCount()</code> to determine how long it has been since the system booted up.⁷ On network devices, Network Device CLI commands such as `show clock detail` can be used to see the current time configuration.⁸ On ESXi servers, `esxcli system clock get` can be used for the same purpose. In addition, system calls – such as <code>time()</code> – have been used to collect the current time on Linux devices.⁹ On macOS systems, adversaries may use commands such as <code>systemsetup -gettimezone</code> or <code>timeIntervalSinceNow</code> to gather current time zone information or current date and time.¹⁰¹¹ This information could be useful for performing other techniques, such as executing a file with a Scheduled Task/Job¹², or to discover locality information based on time zone to assist in victim targeting (i.e. System Location Discovery). Adversaries may also use knowledge of system time as part of a time bomb, or delaying execution until a specified date/time.¹³

1. MSDN System Time
2. Technet Windows Time Service
3. systemsetup mac time
4. Mac Time Sync
5. linux system time
6. Technet Windows Time Service
7. Virtualization/Sandbox Evasion
8. show_clock_detail_cisco_cmd
9. MAGNET GOBLIN
10. System Information Discovery Technique
11. ESET DazzleSpy Jan 2022
12. RSA EU12 They're Inside
13. AnyRun TimeBomb

使用该技术的组织

断言

尚无指向该技术的公开断言。

记录自动入库·未人工复核；置信度与有效期按引用读取。