Windows Security Event 4616 for System Time Changes by Non-Service Accounts
Flags Windows Event 4616 system time changes when made by processes outside svchost.exe and common virtualization agents.
- Product
- windows
- Service
- security
- Author
- @neu5ron (SigmaHQ), DRL 1.1
- Published
- 2019-02-05
- Updated
- 2026-07-31
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows Security Event ID 4616 when the system time is modified and the initiating process/user context does not match common virtualization/host service processes. Attackers may alter system time to evade logging, disrupt scheduling, or impact time-based security controls. The detection relies on Windows Security auditing for system time change events and process/user identifiers included with Event 4616.
Reporting behind it
- Private Cuckoo Sandbox (from many years ago, no longer have hash, NDA as well)Private Cuckoo Sandbox (from many years ago, no longer have hash, NDA as well)
- Live environment caused by malwareLive environment caused by malware
- learn.microsoft.comhttps://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4616
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_time_modification.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Security Event 4616 for System Time Changes by Non-Service Accounts
id: c69671e3-3010-40b7-a9ed-0dedb71a3634
status: test
description: This rule flags Windows Security Event ID 4616 when the system time is modified and the initiating process/user context does not match common virtualization/host service processes. Attackers may alter system time to evade logging, disrupt scheduling, or impact time-based security controls. The detection relies on Windows Security auditing for system time change events and process/user identifiers included with Event 4616.
references:
- Private Cuckoo Sandbox (from many years ago, no longer have hash, NDA as well)
- Live environment caused by malware
- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4616
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_time_modification.yml
author: "@neu5ron, Huntrule Team"
date: 2019-02-05
modified: 2025-12-03
tags:
- attack.stealth
- attack.t1070.006
logsource:
product: windows
service: security
definition: "Requirements: Audit Policy : System > Audit Security State Change, Group Policy : Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Audit Policies\\System\\Audit Security State Change"
detection:
selection:
EventID: 4616
filter_main_svchost:
ProcessName: C:\Windows\System32\svchost.exe
SubjectUserSid: S-1-5-19
filter_optional_vmtools:
ProcessName:
- C:\Program Files\VMware\VMware Tools\vmtoolsd.exe
- C:\Program Files (x86)\VMware\VMware Tools\vmtoolsd.exe
- C:\Windows\System32\VBoxService.exe
- C:\Windows\System32\oobe\msoobe.exe
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
- HyperV or other virtualization technologies with binary not listed in filter portion of detection
level: low
license: DRL-1.1
related:
- id: faa031b5-21ed-4e02-8881-2591f98d82ed
type: derived