Windows System Time Discovery via net.exe or w32tm.exe

title: Windows System Time Discovery via net.exe or w32tm.exe
id: 12b2cacf-82eb-4e6a-aba7-b9069bdf1371
status: test
description: This rule identifies process executions of Windows time-related utilities by matching net.exe/net1.exe commands containing the string "time" or w32tm.exe commands containing "tz". Attackers can use these queries to determine the target system’s time zone and support subsequent actions such as scheduling or timing-dependent operations. Telemetry relies on process creation events with command line and executable path information.
references:
  - https://eqllib.readthedocs.io/en/latest/analytics/fcdb99c2-ac3c-4bde-b664-4b336329bed2.html
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1124/T1124.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_remote_time_discovery.yml
author: E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community, Huntrule Team
date: 2019-10-24
modified: 2022-06-28
tags:
  - attack.discovery
  - attack.t1124
logsource:
  category: process_creation
  product: windows
detection:
  selection_time:
    Image|endswith:
      - \net.exe
      - \net1.exe
    CommandLine|contains: time
  selection_w32tm:
    Image|endswith: \w32tm.exe
    CommandLine|contains: tz
  condition: 1 of selection_*
falsepositives:
  - Legitimate use of the system utilities to discover system time for legitimate reason
level: low
license: DRL-1.1
related:
  - id: b243b280-65fe-48df-ba07-6ddea7646427
    type: derived