Windows: w32tm.exe Timer/Delay Usage via stripchart Parameters

title: "Windows: w32tm.exe Timer/Delay Usage via stripchart Parameters"
id: ecb36087-490d-419d-b950-b4a851c0557b
status: test
description: "This rule identifies execution of w32tm.exe (w32time.dll) when the command line includes stripchart timer-style parameters: /stripchart, /computer:, /period:, /dataonly, and /samples:. Such behavior can be used by adversaries to introduce timing delays or pace activity as part of automated workflows. It relies on Windows process creation telemetry that records process image and command-line arguments."
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/d0dad62dbcae9c60c519368e82c196a3db577055/atomics/T1124/T1124.md
  - https://blogs.blackberry.com/en/2022/05/dirty-deeds-done-dirt-cheap-russian-rat-offers-backdoor-bargains
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_w32tm.yml
author: frack113, Huntrule Team
date: 2022-09-25
tags:
  - attack.discovery
  - attack.t1124
logsource:
  category: process_creation
  product: windows
detection:
  selection_w32tm:
    - Image|endswith: \w32tm.exe
    - OriginalFileName: w32time.dll
  selection_cmd:
    CommandLine|contains|all:
      - /stripchart
      - "/computer:"
      - "/period:"
      - /dataonly
      - "/samples:"
  condition: all of selection_*
falsepositives:
  - Legitimate use
level: high
license: DRL-1.1
related:
  - id: 6da2c9f5-7c53-401b-aacb-92c040ce1215
    type: derived