Description
An adversary may gather the system time and/or time zone settings from a local or remote system. The system time is set and stored by services, such as the Windows Time Service on Windows or systemsetup on macOS.(Citation: MSDN System Time)(Citation: Technet Windows Time Service)(Citation: systemsetup mac time) These time settings may also be synchronized between systems and services in an enterprise network, typically accomplished with a network time server within a domain.(Citation: Mac Time Sync)(Citation: linux system time)
System time information may be gathered in a number of ways, such as with Net on Windows by performing net time \\hostname to gather the system time on a remote system. The victim's time zone may also be inferred from the current system time or gathered by using w32tm /tz.(Citation: Technet Windows Time Service) In addition, adversaries can discover device uptime through functions such as GetTickCount() to determine how long it has been since the system booted up.(Citation: Virtualization/Sandbox Evasion)
On network devices, Network Device CLI commands such as show clock detail can be used to see the current time configuration.(Citation: show_clock_detail_cisco_cmd) On ESXi servers, esxcli system clock get can be used for the same purpose.
In addition, system calls – such as time() – have been used to collect the current time on Linux devices.(Citation: MAGNET GOBLIN) On macOS systems, adversaries may use commands such as systemsetup -gettimezone or timeIntervalSinceNow to gather current time zone information or current date and time.(Citation: System Information Discovery Technique)(Citation: ESET DazzleSpy Jan 2022)
This information could be useful for performing other techniques, such as executing a file with a Scheduled Task/Job(Citation: RSA EU12 They're Inside), or to discover locality information based on time zone to assist in victim targeting (i.e. System Location Discovery). Adversaries may also use knowledge of system time as part of a time bomb, or delaying execution until a specified date/time.(Citation: AnyRun TimeBomb)
Platforms
Threat Groups (14)
| ID | Group | Context |
|---|---|---|
| G0094 | Kimsuky | [Kimsuky](https://attack.mitre.org/groups/G0094) has gathered the system time of the device using the PowerShell cmdlet `Get-Date`.(Citation: Aryaka K... |
| G1017 | Volt Typhoon | [Volt Typhoon](https://attack.mitre.org/groups/G1017) has obtained the victim's system timezone.(Citation: CISA AA24-038A PRC Critical Infrastructure... |
| G0046 | FIN7 | [FIN7](https://attack.mitre.org/groups/G0046) has used the PowerShell script 3CF9.ps1 to execute `net time`.(Citation: BlackBerry_FIN7_April2024) |
| G1012 | CURIUM | [CURIUM](https://attack.mitre.org/groups/G1012) deployed mechanisms to check system time information following strategic website compromise attacks.(C... |
| G0121 | Sidewinder | [Sidewinder](https://attack.mitre.org/groups/G0121) has used tools to obtain the current system time.(Citation: ATT Sidewinder January 2021) |
| G0128 | ZIRCONIUM | [ZIRCONIUM](https://attack.mitre.org/groups/G0128) has used a tool to capture the time on a compromised host in order to register it with C2.(Citation... |
| G1048 | UNC3886 | [UNC3886](https://attack.mitre.org/groups/G1048) has used installation scripts to collect the system time on targeted ESXi hosts.(Citation: Google Clo... |
| G0126 | Higaisa | [Higaisa](https://attack.mitre.org/groups/G0126) used a function to gather the current time.(Citation: Zscaler Higaisa 2020) |
| G0089 | The White Company | [The White Company](https://attack.mitre.org/groups/G0089) has checked the current date on the victim system.(Citation: Cylance Shaheen Nov 2018) |
| G0010 | Turla | [Turla](https://attack.mitre.org/groups/G0010) surveys a system upon check-in to discover the system time by using the <code>net time</code> command.(... |
| G0114 | Chimera | [Chimera](https://attack.mitre.org/groups/G0114) has used <code>time /t</code> and <code>net time \\ip/hostname</code> for system time discovery.(Cita... |
| G0060 | BRONZE BUTLER | [BRONZE BUTLER](https://attack.mitre.org/groups/G0060) has used <code>net time</code> to check the local time on a target system.(Citation: Securework... |
| G0012 | Darkhotel | [Darkhotel](https://attack.mitre.org/groups/G0012) malware can obtain system time from a compromised host.(Citation: Lastline DarkHotel Just In Time D... |
| G0032 | Lazarus Group | A Destover-like implant used by [Lazarus Group](https://attack.mitre.org/groups/G0032) can obtain the current system time and send it to the C2 server... |
Associated Software (83)
| ID | Name | Type | Context |
|---|---|---|---|
| S0139 | PowerDuke | Malware | [PowerDuke](https://attack.mitre.org/software/S0139) has commands to get the time the machine was built, the time, and the time zone.(Citation: Volexi... |
| S0417 | GRIFFON | Malware | [GRIFFON](https://attack.mitre.org/software/S0417) has used a reconnaissance module that can be used to retrieve the date and time of the system.(Cita... |
| S0238 | Proxysvc | Malware | As part of the data reconnaissance phase, [Proxysvc](https://attack.mitre.org/software/S0238) grabs the system time to send back to the control server... |
| S0678 | Torisma | Malware | [Torisma](https://attack.mitre.org/software/S0678) can collect the current time on a victim machine.(Citation: McAfee Lazarus Nov 2020) |
| S0353 | NOKKI | Malware | [NOKKI](https://attack.mitre.org/software/S0353) can collect the current timestamp of the victim's machine.(Citation: Unit 42 NOKKI Sept 2018) |
| S0603 | Stuxnet | Malware | [Stuxnet](https://attack.mitre.org/software/S0603) collects the time and date of a system when it is infected.(Citation: Nicolas Falliere, Liam O Murc... |
| S1053 | AvosLocker | Malware | [AvosLocker](https://attack.mitre.org/software/S1053) has checked the system time before and after encryption.(Citation: Malwarebytes AvosLocker Jul 2... |
| S1233 | PAKLOG | Malware | [PAKLOG](https://attack.mitre.org/software/S1233) has collected a timestamp to log the precise time a key was pressed, formatted as %Y-%m-%d %H:%M:%S.... |
| S0466 | WindTail | Malware | [WindTail](https://attack.mitre.org/software/S0466) has the ability to generate the current date and time.(Citation: objective-see windtail1 dec 2018) |
| S0330 | Zeus Panda | Malware | [Zeus Panda](https://attack.mitre.org/software/S0330) collects the current system time (UTC) and sends it back to the C2 server.(Citation: GDATA Zeus ... |
| S0237 | GravityRAT | Malware | [GravityRAT](https://attack.mitre.org/software/S0237) can obtain the date and time of a system.(Citation: Talos GravityRAT) |
| S1244 | Medusa Ransomware | Malware | [Medusa Ransomware](https://attack.mitre.org/software/S1244) has discovered device uptime through `GetTickCount()`.(Citation: Security Scorecard Medus... |
| S0622 | AppleSeed | Malware | [AppleSeed](https://attack.mitre.org/software/S0622) can pull a timestamp from the victim's machine.(Citation: Malwarebytes Kimsuky June 2021) |
| S0115 | Crimson | Malware | [Crimson](https://attack.mitre.org/software/S0115) has the ability to determine the date and time on a compromised host.(Citation: Kaspersky Transpare... |
| S1159 | DUSTTRAP | Malware | [DUSTTRAP](https://attack.mitre.org/software/S1159) reads the infected system's current time and writes it to a log file during execution.(Citation: G... |
| S1081 | BADHATCH | Malware | [BADHATCH](https://attack.mitre.org/software/S1081) can obtain the `DATETIME` and `UPTIME` from a compromised machine.(Citation: BitDefender BADHATCH ... |
| S1228 | PUBLOAD | Malware | [PUBLOAD](https://attack.mitre.org/software/S1228) has collected the machine’s tick count through the use of `GetTickCount`.(Citation: 2025_IBM_PUBLOA... |
| S9001 | SystemBC | Malware | [SystemBC](https://attack.mitre.org/software/S9001) has leveraged the time of the device to create a text file with a filename that uses the function ... |
| S1178 | ShrinkLocker | Malware | [ShrinkLocker](https://attack.mitre.org/software/S1178) retrieves a system timestamp that is used in generating an encryption key.(Citation: Splunk Sh... |
| S0615 | SombRAT | Malware | [SombRAT](https://attack.mitre.org/software/S0615) can execute <code>getinfo</code> to discover the current time on a compromised host.(Citation: Bla... |
References
- Apple Support. (n.d.). About systemsetup in Remote Desktop. Retrieved March 27, 2024.
- ArchLinux. (2024, February 1). System Time. Retrieved March 27, 2024.
- Check Point Research. (2024, March 8). MAGNET GOBLIN TARGETS PUBLICLY FACING SERVERS USING 1-DAY VULNERABILITIES. Retrieved March 27, 2024.
- Cisco. (2023, March 6). show clock detail - Cisco IOS Security Command Reference: Commands S to Z . Retrieved July 13, 2022.
- Cone, Matt. (2021, January 14). Synchronize your Mac's Clock with a Time Server. Retrieved March 27, 2024.
- M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.
- Malicious History. (2020, September 17). Time Bombs: Malware With Delayed Execution. Retrieved April 22, 2021.
- Mathers, B. (2016, September 30). Windows Time Service Tools and Settings. Retrieved November 25, 2016.
- Microsoft. (n.d.). System Time. Retrieved November 25, 2016.
- Rivner, U., Schwartz, E. (2012). They’re Inside… Now What?. Retrieved November 25, 2016.
Frequently Asked Questions
What is T1124 (System Time Discovery)?
T1124 is a MITRE ATT&CK technique named 'System Time Discovery'. It belongs to the Discovery tactic(s). An adversary may gather the system time and/or time zone settings from a local or remote system. The system time is set and stored by services, such as the Windows Time Service on Windows or <code>sys...
How can T1124 be detected?
Detection of T1124 (System Time Discovery) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.
What mitigations exist for T1124?
Follow defense-in-depth principles including network segmentation, least privilege access, security monitoring, and regular patching to reduce the risk of this technique.
Which threat groups use T1124?
Known threat groups using T1124 include: Kimsuky, Volt Typhoon, FIN7, CURIUM, Sidewinder, ZIRCONIUM, UNC3886, Higaisa.