T1124 · System Time Discovery

Sunturai

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice

T1124 · System Time Discovery · Sunturai

attack-patternenterprise-attackT1124

System Time Discovery

attack-pattern--f3c544dc-673c-4ef3-accb-53229f1ae077

An adversary may gather the system time and/or time zone settings from a local or remote system. The system time is set and stored by services, such as the Windows Time Service on Windows or systemsetup on macOS.(Citation: MSDN System Time) (Citation: Technet Windows Time Service) (Citation: systemsetup mac time) These time settings may also be synchronized between systems and services in an enterprise network, typically accomplished with a network time server within a domain.(Citation: Mac Time Sync) (Citation: linux system time) System time information may be gathered in a number of ways, such as with Net on Windows by performing net time \\hostname to gather the system time on a remote system. The victim's time zone may also be inferred from the current system time or gathered by using w32tm /tz.(Citation: Technet Windows Time Service) In addition, adversaries can discover device uptime through functions such as GetTickCount() to determine how long it has been since the system booted up.(Citation: Virtualization/Sandbox Evasion) On network devices, Network Device CLI commands such as `show clock detail` can be used to see the current time configuration.(Citation: show_clock_detail_cisco_cmd) On ESXi servers, `esxcli system clock get` can be used for the same purpose. In addition, system calls – such as time() – have been used to collect the current time on Linux devices.(Citation: MAGNET GOBLIN) On macOS systems, adversaries may use commands such as systemsetup -gettimezone or timeIntervalSinceNow to gather current time zone information or current date and time.(Citation: System Information Discovery Technique) (Citation: ESET DazzleSpy Jan 2022) This information could be useful for performing other techniques, such as executing a file with a Scheduled Task/Job(Citation: RSA EU12 They're Inside), or to discover locality information based on time zone to assist in victim targeting (i.e. System Location Discovery). Adversaries may also use knowledge of system time as part of a time bomb, or delaying execution until a specified date/time.(Citation: AnyRun TimeBomb)

Created: May 31, 2017, 9:31 PM UTC
Modified: May 12, 2026, 3:12 PM UTC

4 published detections cover this technique

Every one carries the source it came from and the licence it was published under.

Detections covering this technique
Detection	Severity	Source	Published	Licence
Windows System Time Discovery W32tm Delay	Informational	Splunk security content	Oct 13, 2026	Apache License 2.0
Use of W32tm as Timer	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Discovery of a System Time	Low	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Cisco Discovery	Low	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1

Showing 4 of 4

Filter in the catalogue

External references

mitre-attackT1124Open reference

systemsetup mac timeOpen reference

linux system timeOpen reference

MAGNET GOBLINOpen reference

show_clock_detail_cisco_cmdOpen reference

Mac Time SyncOpen reference

ESET DazzleSpy Jan 2022Open reference

AnyRun TimeBombOpen reference

Technet Windows Time ServiceOpen reference

MSDN System TimeOpen reference

RSA EU12 They're InsideOpen reference

System Information Discovery TechniqueOpen reference

Virtualization/Sandbox EvasionOpen reference

Platforms

ESXiLinuxmacOSNetwork DevicesWindows

Kill chain phases

discovery

Relationships

Incoming and outgoing edges in the selected ATT&CK release.

Incoming and outgoing edges in the selected ATT&CK release
Direction	Type	Related object