Time Providers

The Windows Time service (W32Time) enables time synchronization across and within domains. ¹ W32Time time providers are responsible for retrieving time stamps from hardware/network resources and outputting these values to other network clients. ² Time providers are implemented as dynamic-link libraries (DLLs) that are registered in the subkeys of <code>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\W32Time\TimeProviders\</code>. ³ The time provider manager, directed by the service control manager, loads and starts time providers listed and enabled under this key at system startup and/or whenever parameters are changed. ⁴ Adversaries may abuse this architecture to establish Persistence, specifically by registering and enabling a malicious DLL as a time provider. Administrator privileges are required for time provider registration, though execution will run in context of the Local Service account. ⁵

1. Microsoft W32Time Feb 2018
2. Microsoft TimeProvider
3. Microsoft TimeProvider
4. Microsoft TimeProvider
5. Github W32Time Oct 2017

使用该技术的组织

参考表中尚无组织使用记录。

断言

尚无指向该技术的公开断言。

记录自动入库·未人工复核；置信度与有效期按引用读取。