tfMITRE ATT&CK sub-technique

Time Providers T1547.003

sub-technique of T1547 Boot or Logon Autostart Execution

Tactics: Persistence, Privilege Escalation
Platform: Windows
Version: 1.2
Created: 24 January 2020
Last modified: 24 October 2025
Contributors: Scott Lundgren, @5twenty9, Carbon Black; Harun Küßner

Adversaries may abuse time providers to execute DLLs when the system boots. The Windows Time service (W32Time) enables time synchronization across and within domains.[1] W32Time time providers are responsible for retrieving time stamps from hardware/network resources and outputting these values to other network clients.[2]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rules50th pct

Detection rules50th percentile · 50% of ATT&CK techniques have more detection rules written.

Offense vs defense T1547.003

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 1Splunk ESCU (cumulative) · 1

first rule: 2021 Q3

Time Providers detection strategy DET0122

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detect Abuse of Windows Time Providers for Persistence

Enterprise

1 platform

AN0341 · Windows

Behavioral correlation of privileged registry key creation under the W32Time TimeProviders path combined with a new DLL written to disk and potential process activity by LocalService. Indicates abuse of Time Providers for persistence.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Module LoadDC0016	WinEventLog:Sysmon	EventCode=7
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
File CreationDC0039	WinEventLog:Sysmon	EventCode=11
Windows Registry Key ModificationDC0063	WinEventLog:Sysmon	EventCode=13, 14

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
RegistryPathScope	May need to be tuned to only monitor `W32Time\TimeProviders` subkey path for performance optimization
UserContext	Should focus on activity from administrative or SYSTEM accounts
TimeWindow	Controls correlation window between registry modification and DLL drop
DllPathEntropyThreshold	Used for anomaly scoring on DLL path patterns (e.g., random names or temp directories)

Tests2ExecutorsPowerShell 2Need elevation2 of 2Have prerequisites0Have cleanup2Platformswindows

#	Test	Platform	Executor	Elevation	Prereqs	Cleanup
01	Create a new time provider	windows	PowerShell	Required	—	Yes
Establishes persistence by creating a new time provider registry key under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProvider. The new time provider will point to a DLL which will be loaded after the w32time service is started. The DLL will then create the file AtomicTest.txt in C:\Users\Public\ as validation that the test is successful. Payload source code: https://github.com/tr4cefl0w/payloads/tree/master/T1547.003/ Attack command net stop w32time Copy-Item "$PathToAtomicsFolder\T1547.003\bin\AtomicTest.dll" C:\Users\Public\AtomicTest.dll reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\AtomicTest" /t REG_SZ /v "DllName" /d "C:\Users\Public\AtomicTest.dll" /f reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\AtomicTest" /t REG_DWORD /v "Enabled" /d "1" /f reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\AtomicTest" /t REG_DWORD /v "InputProvider" /d "1" /f net start w32time Cleanup command net stop w32time reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\AtomicTest" /f rm -force C:\Users\Public\AtomicTest.dll net start w32time GUID6a8017a0-35fd-4487-a52f-4e5ebb417339
02	Edit an existing time provider	windows	PowerShell	Required	—	Yes
Establishes persistence by editing the NtpServer time provider registry key under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProvider. The time provider will point to a DLL which will be loaded after the w32time service is started. The DLL will then create the file AtomicTest.txt in C:\Users\Public\ as validation that the test is successful. Payload source code: https://github.com/tr4cefl0w/payloads/tree/master/T1547.003/ Attack command net stop w32time Copy-Item "$PathToAtomicsFolder\T1547.003\bin\AtomicTest.dll" C:\Users\Public\AtomicTest.dll reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer" /t REG_SZ /v "DllName" /d "C:\Users\Public\AtomicTest.dll" /f reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer" /t REG_DWORD /v "Enabled" /d "1" /f reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer" /t REG_DWORD /v "InputProvider" /d "1" /f net start w32time Cleanup command net stop w32time reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer" /t REG_SZ /v "DllName" /d "C:\Windows\SYSTEM32\w32time.DLL" /f reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer" /t REG_DWORD /v "Enabled" /d "0" /f reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer" /t REG_DWORD /v "InputProvider" /d "0" /f rm -force C:\Users\Public\AtomicTest.dll net start w32time GUIDfb0b45be-d29a-4152-af80-d691c2b5cd7f

Tests from Atomic Red Team (MIT licence) · technique definition

Time Providers detections T1547.003

2 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

50th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs