tfMITRE ATT&CK technique

System Time Discovery T1124

Tactic: Discovery
Platforms: ESXi, Linux, macOS, Network Devices, Windows
Version: 1.5
Created: 31 May 2017
Last modified: 12 May 2026
Contributors: FIRST.ORG's Cyber Threat Intelligence SIG; Austin Clark, @c2defense

An adversary may gather the system time and/or time zone settings from a local or remote system. The system time is set and stored by services, such as the Windows Time Service on Windows or systemsetup on macOS.[1][2][3] These time settings may also be synchronized between systems and services in an enterprise network, typically accomplished with a network time server within a domain.[4][5]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 13%

Threat groups87th percentile · 86% of ATT&CK techniques have fewer threat groups attributed.

CampaignsTop 12%

Campaigns88th percentile · 83% of ATT&CK techniques have fewer campaigns recorded.

Tools & malwareTop 5%

Tools & malware95th percentile · 95% of ATT&CK techniques have fewer tools implementing them.

Detection rules60th pct

Detection rules60th percentile · 54% of ATT&CK techniques have fewer detection rules written.

tfMITRE ATT&CK technique

System Time Discovery T1124

Tactic: Discovery
Platforms: ESXi, Linux, macOS, Network Devices, Windows
Version: 1.5
Created: 31 May 2017
Last modified: 12 May 2026
Contributors: FIRST.ORG's Cyber Threat Intelligence SIG; Austin Clark, @c2defense

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 13%

Threat groups87th percentile · 86% of ATT&CK techniques have fewer threat groups attributed.

CampaignsTop 12%

Campaigns88th percentile · 83% of ATT&CK techniques have fewer campaigns recorded.

Tools & malwareTop 5%

Tools & malware95th percentile · 95% of ATT&CK techniques have fewer tools implementing them.

Detection rules60th pct

Detection rules60th percentile · 54% of ATT&CK techniques have fewer detection rules written.

System Time Discovery MITRE reference T1124

Top 13%of all ATT&CK techniques for number of groups

14 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

UNC3886G1048 ↗

Has used installation scripts to collect the system time on targeted ESXi hosts.1

created 2025-05-291 reference

Volt TyphoonG1017 ↗

Has obtained the victim's system timezone.1

created 2023-07-271 referenceaka BRONZE SILHOUETTE

CURIUMG1012 ↗

Deployed mechanisms to check system time information following strategic website compromise attacks.1

created 2023-01-131 referenceaka Crimson Sandstorm

ZIRCONIUMG0128 ↗

Has used a tool to capture the time on a compromised host in order to register it with C2.1

created 2021-03-241 referenceaka APT31

HigaisaG0126 ↗

Used a function to gather the current time.1

created 2021-03-051 reference

SidewinderG0121 ↗

Has used tools to obtain the current system time.1

created 2021-01-271 referenceaka T-APT-04

All 14 groups for this technique · 6 newest in this preview

3 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.

C0015C0015 ↗

During C0015, the threat actors used the command net view /all time to gather the local time of a compromised network.1

2021

Operation CuckooBeesC0012 ↗

During Operation CuckooBees, the threat actors used the net time command as part of their advanced reconnaissance.1

2019–2022

Operation WocaoC0014 ↗

During Operation Wocao, threat actors used the time command to retrieve the current time of a compromised system.1

2017–2019

All 3 campaigns for this technique

83 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

Mini Shai-HuludS9043 ↗

Has queried the system timezone configuration and timezone data files to include /etc/localtime, and locale settings to determine the geolocation of the compromised host.1 2

created 2026-07-29MALWAREcarried by 1 group

CanisterWormS9042 ↗

Has checked if the target system’s time zone is “Asia/Tehran” or “Iran.”1 2

created 2026-07-24MALWAREcarried by 1 group

LODEINFOS9020 ↗

Can capture system time to send to the C2.1

created 2026-04-17MALWAREcarried by 1 group

GlassWormS9010 ↗

Has the ability to check the system’s time zone on the victim device.1

created 2026-04-10MALWARE

SystemBCS9001 ↗

Has leveraged the time of the device to create a text file with a filename that uses the function of uniqid(time()).‘.txt, consisting of the 10 character UNIX timestamp and 13 hexadecimal characters.1

created 2025-12-15MALWAREcarried by 3 groups

BeaverTailS1246 ↗

Has obtained and sent the current timestamp associated with the victim device to C2.1

created 2025-10-19MALWAREcarried by 1 group

All 83 software entries for this technique · 6 newest in this preview

Data component	Name	Channel
Scheduled Job CreationDC0001	WinEventLog:TaskScheduler	EventCode=106
Scheduled Job MetadataDC0005	WinEventLog:TaskScheduler	Task registration/execution shortly after a time discovery event
Module LoadDC0016	WinEventLog:Sysmon	EventCode=7
OS API ExecutionDC0021	etw:Microsoft-Windows-Kernel-Process	High-frequency or suspicious sequence of QueryPerformanceCounter/GetTickCount API calls from a non-standard process lineage
Process CreationDC0032	WinEventLog:Security	EventCode=4688
Process MetadataDC0034	EDR:Telemetry	Process lineage and API usage enrichment (GetSystemTime, GetTimeZoneInformation, NtQuerySystemTime)
Process AccessDC0035	WinEventLog:Sysmon	EventCode=10
File CreationDC0039	WinEventLog:Sysmon	EventCode=11
Command ExecutionDC0064	WinEventLog:PowerShell	EventCode=4103, 4104, 4105, 4106

Data component

Name

Channel

Scheduled Job CreationDC0001

WinEventLog:TaskScheduler

EventCode=106

Scheduled Job MetadataDC0005

WinEventLog:TaskScheduler

Task registration/execution shortly after a time discovery event

Module LoadDC0016

WinEventLog:Sysmon

EventCode=7

OS API ExecutionDC0021

etw:Microsoft-Windows-Kernel-Process

High-frequency or suspicious sequence of QueryPerformanceCounter/GetTickCount API calls from a non-standard process lineage

Process CreationDC0032

WinEventLog:Security

EventCode=4688

Process MetadataDC0034

EDR:Telemetry

Process lineage and API usage enrichment (GetSystemTime, GetTimeZoneInformation, NtQuerySystemTime)

Process AccessDC0035

WinEventLog:Sysmon

EventCode=10

File CreationDC0039

WinEventLog:Sysmon

EventCode=11

Command ExecutionDC0064

WinEventLog:PowerShell

EventCode=4103, 4104, 4105, 4106

Field	What you tune
TimeWindow	Correlation window (e.g., 5–15 minutes) between time discovery and follow-on scheduling/conditional actions.
AllowedParents	Legitimate parent processes (e.g., corporate scripts, management agents) that frequently call time APIs.
CommandlineKeywordList	Extend/restrict keyword list for time queries (e.g., custom PS functions, .NET calls).
UserContextScope	Restrict to non-service, non-administrative, or newly created/rare users.
ProcessPrevalenceThreshold	Frequency threshold to exclude common estate-wide benign usage.

Field

What you tune

TimeWindow

Correlation window (e.g., 5–15 minutes) between time discovery and follow-on scheduling/conditional actions.

AllowedParents

Legitimate parent processes (e.g., corporate scripts, management agents) that frequently call time APIs.

CommandlineKeywordList

Extend/restrict keyword list for time queries (e.g., custom PS functions, .NET calls).

UserContextScope

Restrict to non-service, non-administrative, or newly created/rare users.

ProcessPrevalenceThreshold

Frequency threshold to exclude common estate-wide benign usage.

Data component	Name	Channel
User Account AuthenticationDC0002	linux:syslog	sudo/date/timedatectl execution by non-standard users
Scheduled Job MetadataDC0005	linux:cron	cron activity
OS API ExecutionDC0021	auditd:SYSCALL	Rules capturing clock_gettime, time, gettimeofday syscalls when enabled
Process CreationDC0032	auditd:SYSCALL	type=EXECVE or SYSCALL for /bin/date, /usr/bin/timedatectl, /sbin/hwclock, /bin/cat /etc/timezone, /bin/cat /proc/uptime

Field	What you tune
AuditRulesSyscalls	Scope of syscalls (time, clock_gettime, gettimeofday) monitored; may be performance-sensitive.
AllowedBinaries	List of legitimate automation/orchestration tools frequently querying time.
TimeWindow	Correlation window (e.g., 5–20 minutes) to link time discovery to follow-on cron/at changes.
UserContextScope	Ignore root-owned maintenance agents if desired; focus on interactive or newly created users.

Field	What you tune
LaunchdPaths	Organization-specific list of allowed launchd write locations to filter benign agents.
TimeWindow	Correlation window to link time discovery to launchd persistence/scheduling.
AllowedCallers	Known management agents (e.g., JAMF) that legitimately call systemsetup/date.

Field	What you tune
MaintenanceWindow	Only alert if outside approved ops windows.
PrivilegedAccountsAllowList	Suppress alerts for known service accounts.
RemoteIPAllowList	Whitelist management station IPs.
TimeWindow	Correlation between esxcli time query and subsequent hostd/vpxa config calls.

Data component	Name	Channel
File ModificationDC0061	networkdevice:config	config-change: timezone or ntp server configuration change after a time query command
Command ExecutionDC0064	networkdevice:syslog	command-exec: CLI commands containing "show clock", "show clock detail", "show timezone" executed by suspicious user/source

System Time Discovery T1124

System Time Discovery T1124

System Time Discovery MITRE reference T1124

System Time Discovery MITRE reference T1124

Offense vs defense T1124

System Time Discovery detection strategy DET0151

Behavior-chain, platform-aware detection strategy for T1124 System Time Discovery

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

System Time Discovery detections T1124

System Time Discovery detections T1124

Data component	Name	Channel
Scheduled Job MetadataDC0005	macos:unifiedlog	New/modified launchd plist (persistence/scheduling) within TimeWindow after time query
Process CreationDC0032	macos:unifiedlog	process exec events of systemsetup, date, ioreg with command_line parameters indicating time discovery

Data component	Name	Channel
Scheduled Job MetadataDC0005	esxi:syslog	/var/log/vpxa.log task invocations tied to time configuration
Process MetadataDC0034	esxi:hostd	/var/log/hostd.log API calls reading/altering time/ntp settings
Command ExecutionDC0064	esxi:shell	/var/log/shell.log entries containing "esxcli system clock get"

Field	What you tune
AllowedAdminSubnets	Only alert on access from outside the NOC/management subnets.
KnownMaintenanceUsers	Whitelist known automation/orchestration accounts.
TimeWindow	Correlation window between time query and config change.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
	Find information about network devices that is not stored in config files	Generic	test	authentication	-	Cisco AAA · Cisco	Discovery File and Directory Discovery Discovery Password Policy Discovery Discovery Process Discovery Discovery Remote System Discovery Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Network Connections Discovery Discovery System Owner/User Discovery Discovery System Time Discovery	-	low	Austin Clark	2019-08-12	2023-01-04	9705a6a1-6db6-4a16-a987-15b7151e299b
	Identifies use of various commands to query a systems time. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery System Time Discovery	-	low	E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community	2019-10-24	2022-06-28	b243b280-65fe-48df-ba07-6ddea7646427
	When configured with suitable command line arguments, w32tm can act as a delay mechanism	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery System Time Discovery	-	high	frack113	2022-09-25	—	6da2c9f5-7c53-401b-aacb-92c040ce1215
Splunk	The following analytic identifies the use of the w32tm.exe utility with the /stripchart function, which is indicative of DCRat malware delaying its payload execution. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery System Time Discovery	-	medium	Teoderick Contreras, Splunk	2022-07-27	2026-10-02	b2cc69e7-11ba-42dc-a269-59c069a48870