MITRE ATT&CKtechnique

T1124 System Time Discovery

Published 2017-05-31 Modified 2026-09-11 Official page ↗
Domain
enterprise
Tactics
Discovery
Platforms
ESXi, Linux, macOS, Network Devices, Windows
Version
1.5
Created
2017-05-31

Description

An adversary may gather the system time and/or time zone settings from a local or remote system. The system time is set and stored by services, such as the Windows Time Service on Windows or systemsetup on macOS. These time settings may also be synchronized between systems and services in an enterprise network, typically accomplished with a network time server within a domain. System time information may be gathered in a number of ways, such as with Net on Windows by performing net time \\hostname to gather the system time on a remote system. The victim's time zone may also be inferred from the current system time or gathered by using w32tm /tz. In addition, adversaries can discover device uptime through functions such as GetTickCount() to determine how long it has been since the system booted up. On network devices, Network Device CLI commands such as `show clock detail` can be used to see the current time configuration. On ESXi servers, `esxcli system clock get` can be used for the same purpose. In addition, system calls – such as time() – have been used to collect the current time on Linux devices. On macOS systems, adversaries may use commands such as systemsetup -gettimezone or timeIntervalSinceNow to gather current time zone information or current date and time. This information could be useful for performing other techniques, such as executing a file with a Scheduled Task/Job, or to discover locality information based on time zone to assist in victim targeting (i.e. System Location Discovery). Adversaries may also use knowledge of system time as part of a time bomb, or delaying execution until a specified date/time.

Related

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · uses (104)

  • S9058 SIGHTGRAB software (malware)
  • S9050 Vidar software (malware)
  • S9046 IOControl software (malware)
  • S9043 Mini Shai-Hulud software (malware)
  • S9042 CanisterWorm software (malware)
  • S9020 LODEINFO software (malware)
  • S9010 GlassWorm software (malware)
  • S9001 SystemBC software (malware)
  • S1246 BeaverTail software (malware)
  • S1244 Medusa Ransomware software (malware)
  • S1233 PAKLOG software (malware)
  • S1228 PUBLOAD software (malware)
  • S1227 StarProxy software (malware)
  • G1048 UNC3886 group
  • S1178 ShrinkLocker software (malware)
  • S1159 DUSTTRAP software (malware)
  • S1148 Raccoon Stealer software (malware)
  • S1147 Nightdoor software (malware)
  • S1134 DEADWOOD software (malware)
  • S1111 DarkGate software (malware)
  • S1087 AsyncRAT software (tool)
  • S1081 BADHATCH software (malware)
  • G1017 Volt Typhoon group
  • S1064 SVCReady software (malware)
  • G1012 CURIUM group
  • S1053 AvosLocker software (malware)
  • S1051 KEYPLUG software (malware)
  • C0015 C0015 campaign
  • C0014 Operation Wocao campaign
  • S1044 FunnyDream software (malware)
Show all 104 ›

Referenced by CAPEC · att&ck technique (1)

References