MITRE ATT&CK technique
System Time Discovery detection rulesT1124
System Time Discovery (T1124) is a MITRE ATT&CK technique in the Discovery tactic. This page lists the 3 community-maintained Sigma detection rules in the library mapped to T1124 and its sub-techniques. Each rule includes its detection logic, log source, false positives and original YAML. These rules mainly target windows, cisco.
T1124 on attack.mitre.org3 rules
Use of W32tm as Timer
highWhen configured with suitable command line arguments, w32tm can act as a delay mechanism
windows · process_creation
Cisco Discovery
lowFind information about network devices that is not stored in config files
cisco
Discovery of a System Time
lowIdentifies use of various commands to query a systems time. This technique may be used before executing a scheduled task or to discover the time zone of a target system.
windows · process_creation