Windows Security Event 4616 for System Time Changes by Non-System Processes

Flags Windows Event 4616 system time changes when made by processes outside svchost.exe and common virtualization agents.

FreeUnreviewedSigmalowv1

windows-security-event-4616-for-system-time-changes-by-non-system-processes-faa031b5

title: Windows Security Event 4616 for System Time Changes by Non-System Processes
id: c69671e3-3010-40b7-a9ed-0dedb71a3634
status: test
description: This rule flags Windows Security Event ID 4616 when the system time is modified by a process other than the expected system host (svchost.exe running as the local service SID). Attackers may change system time to disrupt logs, invalidate security controls, or affect time-based detections. It relies on Windows Security audit telemetry for 4616 and uses process path and subject user SID filtering to reduce noise from known virtualization and host components.
references:
  - Private Cuckoo Sandbox (from many years ago, no longer have hash, NDA as well)
  - Live environment caused by malware
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4616
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_time_modification.yml
author: "@neu5ron, Huntrule Team"
date: 2019-02-05
modified: 2025-12-03
tags:
  - attack.stealth
  - attack.t1070.006
logsource:
  product: windows
  service: security
  definition: "Requirements: Audit Policy : System > Audit Security State Change, Group Policy : Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Audit Policies\\System\\Audit Security State Change"
detection:
  selection:
    EventID: 4616
  filter_main_svchost:
    ProcessName: C:\Windows\System32\svchost.exe
    SubjectUserSid: S-1-5-19
  filter_optional_vmtools:
    ProcessName:
      - C:\Program Files\VMware\VMware Tools\vmtoolsd.exe
      - C:\Program Files (x86)\VMware\VMware Tools\vmtoolsd.exe
      - C:\Windows\System32\VBoxService.exe
      - C:\Windows\System32\oobe\msoobe.exe
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - HyperV or other virtualization technologies with binary not listed in filter portion of detection
level: low
license: DRL-1.1
related:
  - id: faa031b5-21ed-4e02-8881-2591f98d82ed
    type: derived

What it detects

This rule flags Windows Security Event ID 4616 when the system time is modified by a process other than the expected system host (svchost.exe running as the local service SID). Attackers may change system time to disrupt logs, invalidate security controls, or affect time-based detections. It relies on Windows Security audit telemetry for 4616 and uses process path and subject user SID filtering to reduce noise from known virtualization and host components.

Known false positives

HyperV or other virtualization technologies with binary not listed in filter portion of detection

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.