القائمة
An adversary may gather the system time and/or time zone settings from a local or remote system.
يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.
اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.
استنادا إلى تصنيف SOC المهني
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
يتجاوز الأمر المباشر Prompt المخصّص للمراجعة. افحص المصدر قبل تشغيله.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill t1124-system-time-discoveryيبقى الأمر في سطر واحد. مرّر أفقيًا لمراجعته كاملًا قبل النسخ.
تفضّل نسخة محلية؟ نزّل الملفات المتاحة حاليًا لدى SkillsMP.
عرض SKILL.md
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
| name | T1124_system-time-discovery |
| description | An adversary may gather the system time and/or time zone settings from a local or remote system. |
| category | information-gathering |
| version | 18.1 |
| author | cyberstrike-official |
| tags | ["mitre-attack","enterprise","t1124","discovery","esxi","linux","macos","network-devices","windows"] |
| technique_id | T1124 |
| tactic | discovery |
| all_tactics | ["discovery"] |
| platforms | ["ESXi","Linux","macOS","Network Devices","Windows"] |
| mitre_url | https://attack.mitre.org/techniques/T1124 |
| tech_stack | ["esxi","linux","macos","network devices","windows"] |
| cwe_ids | ["CWE-200"] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
An adversary may gather the system time and/or time zone settings from a local or remote system. The system time is set and stored by services, such as the Windows Time Service on Windows or systemsetup on macOS. These time settings may also be synchronized between systems and services in an enterprise network, typically accomplished with a network time server within a domain.
System time information may be gathered in a number of ways, such as with Net on Windows by performing net time \hostname to gather the system time on a remote system. The victim's time zone may also be inferred from the current system time or gathered by using w32tm /tz. In addition, adversaries can discover device uptime through functions such as GetTickCount() to determine how long it has been since the system booted up.
On network devices, Network Device CLI commands such as show clock detail can be used to see the current time configuration. On ESXi servers, esxcli system clock get can be used for the same purpose.
In addition, system calls – such as time() – have been used to collect the current time on Linux devices. On macOS systems, adversaries may use commands such as systemsetup -gettimezone or timeIntervalSinceNow to gather current time zone information or current date and time.
This information could be useful for performing other techniques, such as executing a file with a Scheduled Task/Job, or to discover locality information based on time zone to assist in victim targeting (i.e. System Location Discovery). Adversaries may also use knowledge of system time as part of a time bomb, or delaying execution until a specified date/time.
Platforms: ESXi, Linux, macOS, Network Devices, Windows
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Identify the system time. Upon execution, the local computer system time and timezone will be displayed.
Supported Platforms: windows
net time \\#{computer_name}
w32tm /tz
Identify the system time via PowerShell. Upon execution, the system time will be displayed.
Supported Platforms: windows
Get-Date
Identify system time. Upon execution, the local computer system time and timezone will be displayed.
Supported Platforms: linux, macos
date
identifies DCRat delay time tactics using w32tm. https://research.splunk.com/endpoint/b2cc69e7-11ba-42dc-a269-59c069a48870/ https://blogs.blackberry.com/en/2022/05/dirty-deeds-done-dirt-cheap-russian-rat-offers-backdoor-bargains
Supported Platforms: windows
W32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Displays the current system time via the Windows builtin time command: https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/time Recently observed in use in the wild during an incident involving Ursnif malware: https://github.com/The-DFIR-Report/Sigma-Rules/blob/dc72f0b557fc63347379be0a33439788256761c8/rules/windows/process_creation/proc_creation_win_system_time_lookup.yml https://thedfirreport.com/2023/01/09/unwrapping-ursnifs-gifts/
Supported Platforms: windows
time
If Atomic Red Team tests are not applicable, manually verify the technique by:
Identify Attack Surface: Determine if the target environment is susceptible to System Time Discovery by examining the target platforms (ESXi, Linux, macOS).
Assess Existing Defenses: Review whether mitigations for T1124 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
No specific mitigations documented for this technique.
| Finding | Severity | Impact |
|---|---|---|
| System Time Discovery technique applicable | Medium | Discovery |
| CWE ID | Title |
|---|---|
| CWE-200 | Exposure of Sensitive Information |