Windows Registry: New W32Time TimeProvider DllName Values Set Under Services\W32Time\TimeProvider

title: "Windows Registry: New W32Time TimeProvider DllName Values Set Under Services\\W32Time\\TimeProvider"
id: 413ed07e-6ce4-4219-b63c-b5a70bfa36dc
status: test
description: This rule flags registry updates that create or modify a W32Time TimeProvider entry with a DLL name under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProvider. Attackers may abuse Windows Time service configuration to have a specified DLL loaded during system boot or time-provider initialization. The detection relies on registry set telemetry capturing TargetObject paths and matching the end of the DllName value name, while filtering out a few known DLL entries.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.003/T1547.003.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_timeproviders_dllname.yml
author: frack113, Huntrule Team
date: 2022-06-19
modified: 2024-03-26
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1547.003
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains: \Services\W32Time\TimeProviders
    TargetObject|endswith: \DllName
  filter_main_w32time:
    Details:
      - "%SystemRoot%\\System32\\vmictimeprovider.dll"
      - "%systemroot%\\system32\\w32time.dll"
      - C:\Windows\SYSTEM32\w32time.DLL
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: e88a6ddc-74f7-463b-9b26-f69fc0d2ce85
    type: derived