tfMITRE ATT&CK technique

System Time Discovery T1124

Tactic: Discovery
Platforms: ESXi, Linux, macOS, Network Devices, Windows
Version: 1.5
Created: 31 May 2017
Last modified: 12 May 2026
Contributors: FIRST.ORG's Cyber Threat Intelligence SIG; Austin Clark, @c2defense

An adversary may gather the system time and/or time zone settings from a local or remote system. The system time is set and stored by services, such as the Windows Time Service on Windows or systemsetup on macOS.[1][2][3] These time settings may also be synchronized between systems and services in an enterprise network, typically accomplished with a network time server within a domain.[4][5]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 13%

Threat groups87th percentile · 87% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsTop 12%

Campaigns88th percentile · 88% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malwareTop 5%

Tools & malware95th percentile · 95% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules60th pct

Detection rules60th percentile · 60% of ATT&CK techniques have this many detection rules written or fewer.

System Time Discovery MITRE reference T1124

Top 13%of all ATT&CK techniques for number of groups

14 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

UNC3886G1048 ↗

Has used installation scripts to collect the system time on targeted ESXi hosts.1

created 2025-05-291 reference

Volt TyphoonG1017 ↗

Has obtained the victim's system timezone.1

created 2023-07-271 referenceaka BRONZE SILHOUETTE

CURIUMG1012 ↗

Deployed mechanisms to check system time information following strategic website compromise attacks.1

created 2023-01-131 referenceaka Crimson Sandstorm

ZIRCONIUMG0128 ↗

Has used a tool to capture the time on a compromised host in order to register it with C2.1

created 2021-03-241 referenceaka APT31

HigaisaG0126 ↗

Used a function to gather the current time.1

created 2021-03-051 reference

SidewinderG0121 ↗

Has used tools to obtain the current system time.1

created 2021-01-271 referenceaka T-APT-04

All 14 groups for this technique · 6 newest in this preview

3 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.

C0015C0015 ↗

During C0015, the threat actors used the command net view /all time to gather the local time of a compromised network.1

2021

Operation CuckooBeesC0012 ↗

During Operation CuckooBees, the threat actors used the net time command as part of their advanced reconnaissance.1

2019–2022

Operation WocaoC0014 ↗

During Operation Wocao, threat actors used the time command to retrieve the current time of a compromised system.1

2017–2019

All 3 campaigns for this technique

83 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

Mini Shai-HuludS9043 ↗

Has queried the system timezone configuration and timezone data files to include /etc/localtime, and locale settings to determine the geolocation of the compromised host.1 2

created 2026-07-29MALWAREcarried by 1 group

CanisterWormS9042 ↗

Has checked if the target system’s time zone is “Asia/Tehran” or “Iran.”1 2

created 2026-07-24MALWAREcarried by 1 group

LODEINFOS9020 ↗

Can capture system time to send to the C2.1

created 2026-04-17MALWAREcarried by 1 group

GlassWormS9010 ↗

Has the ability to check the system’s time zone on the victim device.1

created 2026-04-10MALWARE

SystemBCS9001 ↗

Has leveraged the time of the device to create a text file with a filename that uses the function of uniqid(time()).‘.txt, consisting of the 10 character UNIX timestamp and 13 hexadecimal characters.1

created 2025-12-15MALWAREcarried by 3 groups

BeaverTailS1246 ↗

Has obtained and sent the current timestamp associated with the victim device to C2.1

created 2025-10-19MALWAREcarried by 1 group

All 83 software entries for this technique · 6 newest in this preview

Offense vs defense T1124

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 3Sigma rules (cumulative) · 3Splunk ESCU (cumulative) · 1

first rule: 2019 Q3 · 3 of 3 campaigns plotted

System Time Discovery detection strategy DET0151

MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Behavior-chain, platform-aware detection strategy for T1124 System Time Discovery

Enterprise

5 platforms

AN0430 · Windows

Untrusted or unusual process/script (cmd.exe, powershell.exe, w32tm.exe, net.exe, custom binaries) queries system time/timezone (e.g., w32tm /tz, net time \\host, Get-TimeZone, GetTickCount API) and (optionally) is followed within a short window by time-based scheduling or conditional execution (e.g., schtasks /create, at.exe, PowerShell Start-Sleep with large values).

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Scheduled Job CreationDC0001	WinEventLog:TaskScheduler	EventCode=106
Scheduled Job MetadataDC0005	WinEventLog:TaskScheduler	Task registration/execution shortly after a time discovery event
Module LoadDC0016	WinEventLog:Sysmon	EventCode=7
OS API ExecutionDC0021	etw:Microsoft-Windows-Kernel-Process	High-frequency or suspicious sequence of QueryPerformanceCounter/GetTickCount API calls from a non-standard process lineage
Process CreationDC0032	WinEventLog:Security	EventCode=4688
Process MetadataDC0034	EDR:Telemetry	Process lineage and API usage enrichment (GetSystemTime, GetTimeZoneInformation, NtQuerySystemTime)
Process AccessDC0035	WinEventLog:Sysmon	EventCode=10
File CreationDC0039	WinEventLog:Sysmon	EventCode=11
Command ExecutionDC0064	WinEventLog:PowerShell	EventCode=4103, 4104, 4105, 4106

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Correlation window (e.g., 5–15 minutes) between time discovery and follow-on scheduling/conditional actions.
AllowedParents	Legitimate parent processes (e.g., corporate scripts, management agents) that frequently call time APIs.
CommandlineKeywordList	Extend/restrict keyword list for time queries (e.g., custom PS functions, .NET calls).
UserContextScope	Restrict to non-service, non-administrative, or newly created/rare users.
ProcessPrevalenceThreshold	Frequency threshold to exclude common estate-wide benign usage.

AN0431 · Linux

A process (often spawned by a shell, interpreter, or malware implant) executes time discovery via commands (date, timedatectl, hwclock, cat /etc/timezone, /proc/uptime) or direct syscalls (time(), clock_gettime) and is (optionally) followed by scheduled task creation/modification (crontab, at) or conditional sleep logic.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account AuthenticationDC0002	linux:syslog	sudo/date/timedatectl execution by non-standard users
Scheduled Job MetadataDC0005	linux:cron	cron activity
OS API ExecutionDC0021	auditd:SYSCALL	Rules capturing clock_gettime, time, gettimeofday syscalls when enabled
Process CreationDC0032	auditd:SYSCALL	type=EXECVE or SYSCALL for /bin/date, /usr/bin/timedatectl, /sbin/hwclock, /bin/cat /etc/timezone, /bin/cat /proc/uptime

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
AuditRulesSyscalls	Scope of syscalls (time, clock_gettime, gettimeofday) monitored; may be performance-sensitive.
AllowedBinaries	List of legitimate automation/orchestration tools frequently querying time.
TimeWindow	Correlation window (e.g., 5–20 minutes) to link time discovery to follow-on cron/at changes.
UserContextScope	Ignore root-owned maintenance agents if desired; focus on interactive or newly created users.

AN0432 · macOS

Process/script execution of systemsetup -gettimezone, date, ioreg, or API usage (timeIntervalSinceNow, gettimeofday) followed by time-based scheduling (launchd plist modification) or sleep-based execution.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Scheduled Job MetadataDC0005	macos:unifiedlog	New/modified launchd plist (persistence/scheduling) within TimeWindow after time query
Process CreationDC0032	macos:unifiedlog	process exec events of systemsetup, date, ioreg with command_line parameters indicating time discovery

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
LaunchdPaths	Organization-specific list of allowed launchd write locations to filter benign agents.
TimeWindow	Correlation window to link time discovery to launchd persistence/scheduling.
AllowedCallers	Known management agents (e.g., JAMF) that legitimately call systemsetup/date.

AN0433 · ESXi

Interactive or remote shell/API invocation of esxcli system clock get or querying time parameters via hostd/vpxa shortly followed by time/ntp configuration checks or scheduled task creation, executed by non-standard accounts or outside maintenance windows.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Scheduled Job MetadataDC0005	esxi:syslog	/var/log/vpxa.log task invocations tied to time configuration
Process MetadataDC0034	esxi:hostd	/var/log/hostd.log API calls reading/altering time/ntp settings
Command ExecutionDC0064	esxi:shell	/var/log/shell.log entries containing "esxcli system clock get"

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
MaintenanceWindow	Only alert if outside approved ops windows.
PrivilegedAccountsAllowList	Suppress alerts for known service accounts.
RemoteIPAllowList	Whitelist management station IPs.
TimeWindow	Correlation between esxcli time query and subsequent hostd/vpxa config calls.

AN0434 · Network Devices

Non-standard or rare users/locations issue CLI commands like "show clock detail" or "show timezone"; optionally followed by configuration of time/timezone or NTP sources. AAA/TACACS+ accounting and syslog correlate execution to identity, source IP, and privilege level.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File ModificationDC0061	networkdevice:config	config-change: timezone or ntp server configuration change after a time query command
Command ExecutionDC0064	networkdevice:syslog	command-exec: CLI commands containing "show clock", "show clock detail", "show timezone" executed by suspicious user/source

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
AllowedAdminSubnets	Only alert on access from outside the NOC/management subnets.
KnownMaintenanceUsers	Whitelist known automation/orchestration accounts.
TimeWindow	Correlation window between time query and config change.

Tests6Executorscmd 4 · PowerShell 1 · sh 1Need elevation0 of 6Have prerequisites0Have cleanup0Platformswindows, linux, macos

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

System Time Discovery

windows

cmd

—

Identify the system time. Upon execution, the local computer system time and timezone will be displayed.

Input arguments

Name	Type	Default	Description
computer_name	string	localhost	computer name to query

Attack command

net time \\#{computer_name}
w32tm /tz

GUID21af9e7a-c9d8-49c9-9b74-ab54e6eccf52

System Time Discovery - PowerShell

windows

PowerShell

—

System Time Discovery in FreeBSD/macOS

linux, macos

—

System Time Discovery W32tm as a Delay

windows

cmd

—

System Time with Windows time Command

windows

cmd

—

Discover System Time Zone via Registry

windows

cmd

—

Tests from Atomic Red Team (MIT licence) · technique definition

System Time Discovery detections T1124

4 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

60th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs