Esc

System Time Discovery - T1124

(ATT&CK® Technique)

Definition

An adversary may gather the system time and/or time zone settings from a local or remote system. The system time is set and stored by services, such as the Windows Time Service on Windows or systemsetup on macOS. These time settings may also be synchronized between systems and services in an enterprise network, typically accomplished with a network time server within a domain.

D3FEND Inferred Relationships

Browse the D3FEND knowledge graph by clicking on the nodes below.

        graph LR;

     T1124["System Time Discovery"] --> |may-invoke| CreateProcess["Create Process"]; class T1124 OffensiveTechniqueNode;
        class CreateProcess ArtifactNode; click CreateProcess href "/dao/artifact/d3f:CreateProcess";
        click T1124 href "/offensive-technique/attack/T1124/"; click CreateProcess href "/dao/artifact/d3f:CreateProcess"; T1124["System Time Discovery"] --> |may-invoke| GetSystemTime["Get System Time"]; class T1124 OffensiveTechniqueNode;
        class GetSystemTime ArtifactNode; click GetSystemTime href "/dao/artifact/d3f:GetSystemTime";
        click T1124 href "/offensive-technique/attack/T1124/"; click GetSystemTime href "/dao/artifact/d3f:GetSystemTime";                          ProcessSpawnAnalysis["Process Spawn Analysis"] -->
          | analyzes | CreateProcess["Create Process"];

          ProcessSpawnAnalysis["Process Spawn Analysis"] -.->
            | may-detect | T1124["System Time Discovery"] ;
          class ProcessSpawnAnalysis DefensiveTechniqueNode;
          class CreateProcess ArtifactNode;
          click ProcessSpawnAnalysis href "/technique/d3f:ProcessSpawnAnalysis"; SystemCallAnalysis["System Call Analysis"] -->
          | analyzes | CreateProcess["Create Process"];

          SystemCallAnalysis["System Call Analysis"] -.->
            | may-detect | T1124["System Time Discovery"] ;
          class SystemCallAnalysis DefensiveTechniqueNode;
          class CreateProcess ArtifactNode;
          click SystemCallAnalysis href "/technique/d3f:SystemCallAnalysis"; SystemCallAnalysis["System Call Analysis"] -->
          | analyzes | GetSystemTime["Get System Time"];

          
          class SystemCallAnalysis DefensiveTechniqueNode;
          class GetSystemTime ArtifactNode;
          click SystemCallAnalysis href "/technique/d3f:SystemCallAnalysis";                                        ExecutableDenylisting["Executable Denylisting"] -->
          | filters | CreateProcess["Create Process"];

          ExecutableDenylisting["Executable Denylisting"] -.->
            | may-isolate | T1124["System Time Discovery"] ;
          class ExecutableDenylisting DefensiveTechniqueNode;
          class CreateProcess ArtifactNode;
          click ExecutableDenylisting href "/technique/d3f:ExecutableDenylisting"; Hardware-basedProcessIsolation["Hardware-based Process Isolation"] -->
          | restricts | CreateProcess["Create Process"];

          Hardware-basedProcessIsolation["Hardware-based Process Isolation"] -.->
            | may-isolate | T1124["System Time Discovery"] ;
          class Hardware-basedProcessIsolation DefensiveTechniqueNode;
          class CreateProcess ArtifactNode;
          click Hardware-basedProcessIsolation href "/technique/d3f:Hardware-basedProcessIsolation";                           ExecutableAllowlisting["Executable Allowlisting"] -->
          | filters | CreateProcess["Create Process"];

          ExecutableAllowlisting["Executable Allowlisting"] -.->
            | may-isolate | T1124["System Time Discovery"] ;
          class ExecutableAllowlisting DefensiveTechniqueNode;
          class CreateProcess ArtifactNode;
          click ExecutableAllowlisting href "/technique/d3f:ExecutableAllowlisting";              SystemCallFiltering["System Call Filtering"] -->
          | filters | GetSystemTime["Get System Time"];

          SystemCallFiltering["System Call Filtering"] -.->
            | may-isolate | T1124["System Time Discovery"] ;
          class SystemCallFiltering DefensiveTechniqueNode;
          class GetSystemTime ArtifactNode;
          click SystemCallFiltering href "/technique/d3f:SystemCallFiltering"; SystemCallFiltering["System Call Filtering"] -->
          | filters | CreateProcess["Create Process"];

          
          class SystemCallFiltering DefensiveTechniqueNode;
          class CreateProcess ArtifactNode;
          click SystemCallFiltering href "/technique/d3f:SystemCallFiltering";

json