Windows System Time Discovery via net.exe or w32tm.exe
Flags Windows net.exe/net1.exe or w32tm.exe command lines used to query system time/time zone.
- Product
- windows
- Category
- process_creation
- Author
- E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community (SigmaHQ), DRL 1.1
- Published
- 2019-10-24
- Updated
- 2026-07-30
ATT&CK techniques
DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies process executions of Windows time-related utilities by matching net.exe/net1.exe commands containing the string "time" or w32tm.exe commands containing "tz". Attackers can use these queries to determine the target system’s time zone and support subsequent actions such as scheduling or timing-dependent operations. Telemetry relies on process creation events with command line and executable path information.
Reporting behind it
- eqllib.readthedocs.iohttps://eqllib.readthedocs.io/en/latest/analytics/fcdb99c2-ac3c-4bde-b664-4b336329bed2.html
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1124/T1124.md
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_remote_time_discovery.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows System Time Discovery via net.exe or w32tm.exe
id: 12b2cacf-82eb-4e6a-aba7-b9069bdf1371
status: test
description: This rule identifies process executions of Windows time-related utilities by matching net.exe/net1.exe commands containing the string "time" or w32tm.exe commands containing "tz". Attackers can use these queries to determine the target system’s time zone and support subsequent actions such as scheduling or timing-dependent operations. Telemetry relies on process creation events with command line and executable path information.
references:
- https://eqllib.readthedocs.io/en/latest/analytics/fcdb99c2-ac3c-4bde-b664-4b336329bed2.html
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1124/T1124.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_remote_time_discovery.yml
author: E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community, Huntrule Team
date: 2019-10-24
modified: 2022-06-28
tags:
- attack.discovery
- attack.t1124
logsource:
category: process_creation
product: windows
detection:
selection_time:
Image|endswith:
- \net.exe
- \net1.exe
CommandLine|contains: time
selection_w32tm:
Image|endswith: \w32tm.exe
CommandLine|contains: tz
condition: 1 of selection_*
falsepositives:
- Legitimate use of the system utilities to discover system time for legitimate reason
level: low
license: DRL-1.1
related:
- id: b243b280-65fe-48df-ba07-6ddea7646427
type: derived