Windows Registry: New W32Time TimeProvider DllName Values Set Under Services\W32Time\TimeProvider
Alerts on new or changed W32Time TimeProvider DllName registry values under Services\W32Time\TimeProvider.
- Product
- windows
- Category
- registry_set
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-06-19
- Updated
- 2026-07-30
ATT&CK techniques
Persistence → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags registry updates that create or modify a W32Time TimeProvider entry with a DLL name under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProvider. Attackers may abuse Windows Time service configuration to have a specified DLL loaded during system boot or time-provider initialization. The detection relies on registry set telemetry capturing TargetObject paths and matching the end of the DllName value name, while filtering out a few known DLL entries.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Registry: New W32Time TimeProvider DllName Values Set Under Services\\W32Time\\TimeProvider"
id: 413ed07e-6ce4-4219-b63c-b5a70bfa36dc
status: test
description: This rule flags registry updates that create or modify a W32Time TimeProvider entry with a DLL name under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProvider. Attackers may abuse Windows Time service configuration to have a specified DLL loaded during system boot or time-provider initialization. The detection relies on registry set telemetry capturing TargetObject paths and matching the end of the DllName value name, while filtering out a few known DLL entries.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.003/T1547.003.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_timeproviders_dllname.yml
author: frack113, Huntrule Team
date: 2022-06-19
modified: 2024-03-26
tags:
- attack.persistence
- attack.privilege-escalation
- attack.t1547.003
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains: \Services\W32Time\TimeProviders
TargetObject|endswith: \DllName
filter_main_w32time:
Details:
- "%SystemRoot%\\System32\\vmictimeprovider.dll"
- "%systemroot%\\system32\\w32time.dll"
- C:\Windows\SYSTEM32\w32time.DLL
condition: selection and not 1 of filter_main_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: e88a6ddc-74f7-463b-9b26-f69fc0d2ce85
type: derived