Windows: w32tm.exe Timer/Delay Usage via stripchart Parameters
Flags w32tm.exe executions using stripchart delay-related parameters that can support timed automation on Windows.
- Product
- windows
- Category
- process_creation
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-09-25
- Updated
- 2026-07-30
ATT&CK techniques
DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies execution of w32tm.exe (w32time.dll) when the command line includes stripchart timer-style parameters: /stripchart, /computer:, /period:, /dataonly, and /samples:. Such behavior can be used by adversaries to introduce timing delays or pace activity as part of automated workflows. It relies on Windows process creation telemetry that records process image and command-line arguments.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/d0dad62dbcae9c60c519368e82c196a3db577055/atomics/T1124/T1124.md
- blogs.blackberry.comhttps://blogs.blackberry.com/en/2022/05/dirty-deeds-done-dirt-cheap-russian-rat-offers-backdoor-bargains
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_w32tm.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: w32tm.exe Timer/Delay Usage via stripchart Parameters"
id: ecb36087-490d-419d-b950-b4a851c0557b
status: test
description: "This rule identifies execution of w32tm.exe (w32time.dll) when the command line includes stripchart timer-style parameters: /stripchart, /computer:, /period:, /dataonly, and /samples:. Such behavior can be used by adversaries to introduce timing delays or pace activity as part of automated workflows. It relies on Windows process creation telemetry that records process image and command-line arguments."
references:
- https://github.com/redcanaryco/atomic-red-team/blob/d0dad62dbcae9c60c519368e82c196a3db577055/atomics/T1124/T1124.md
- https://blogs.blackberry.com/en/2022/05/dirty-deeds-done-dirt-cheap-russian-rat-offers-backdoor-bargains
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_w32tm.yml
author: frack113, Huntrule Team
date: 2022-09-25
tags:
- attack.discovery
- attack.t1124
logsource:
category: process_creation
product: windows
detection:
selection_w32tm:
- Image|endswith: \w32tm.exe
- OriginalFileName: w32time.dll
selection_cmd:
CommandLine|contains|all:
- /stripchart
- "/computer:"
- "/period:"
- /dataonly
- "/samples:"
condition: all of selection_*
falsepositives:
- Legitimate use
level: high
license: DRL-1.1
related:
- id: 6da2c9f5-7c53-401b-aacb-92c040ce1215
type: derived