Detect system time and time zone discovery on the command line

Siemphony@siemphonylowT1124unverified

Matches process-creation command lines that read the host clock or time zone: `w32tm /tz`, `net time \\host` against a remote machine, `tzutil /g`, and the PowerShell and .NET equivalents. These are MITRE's CommandlineKeywordList knob written out as literals, kept on one field so the rule renders in every backend. The analytic's second half — the same actor scheduling work or sleeping on a large interval within a short window afterwards — is a time-windowed correlation Sigma cannot express, so this is only the discovery precursor and will fire on its own whether or not anything follows. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0151, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (ProcessCommandLine contains "w32tm /tz" or ProcessCommandLine contains "w32tm -tz" or ProcessCommandLine contains "w32tm /query /status" or ProcessCommandLine contains "net time \\" or ProcessCommandLine contains "tzutil /g" or ProcessCommandLine contains "tzutil -g" or ProcessCommandLine contains "Get-TimeZone" or ProcessCommandLine contains "[System.TimeZoneInfo]" or ProcessCommandLine contains "Get-Date -Format")

Splunk · SPL

Run this as a search.

index=* (CommandLine="*w32tm /tz*" OR CommandLine="*w32tm -tz*" OR CommandLine="*w32tm /query /status*" OR CommandLine="*net time \\*" OR CommandLine="*tzutil /g*" OR CommandLine="*tzutil -g*" OR CommandLine="*Get-TimeZone*" OR CommandLine="*[System.TimeZoneInfo]*" OR CommandLine="*Get-Date -Format*")

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(process.command_line) LIKE "*w32tm /tz*" OR TO_LOWER(process.command_line) LIKE "*w32tm -tz*" OR TO_LOWER(process.command_line) LIKE "*w32tm /query /status*" OR TO_LOWER(process.command_line) LIKE "*net time \\\\*" OR TO_LOWER(process.command_line) LIKE "*tzutil /g*" OR TO_LOWER(process.command_line) LIKE "*tzutil -g*" OR TO_LOWER(process.command_line) LIKE "*get-timezone*" OR TO_LOWER(process.command_line) LIKE "*[system.timezoneinfo]*" OR TO_LOWER(process.command_line) LIKE "*get-date -format*")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)(w32tm /tz|w32tm -tz|w32tm /query /status|net time \\|tzutil /g|tzutil -g|Get-TimeZone|\[System\.TimeZoneInfo\]|Get-Date -Format)</field>    <description>Detect system time and time zone discovery on the command line</description>    <mitre>      <id>T1124</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: low
Category: discovery_recon
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 664bda20-d2a9-4bf8-a83e-9e19f4ca9578

ATT&CKT1124

T1124System Time Discovery

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessondiscovery recon

discovery reconAI draft — unreviewed

01 · What this rule detects

AN0430 has two halves. First, an unusual process queries the system time or time zone. Second — optionally, within a short window — the same actor schedules work or sleeps on a large interval, which is what turns a clock reading into staging. Sigma cannot express "and then, within five minutes", so this rule implements the first half alone and fires whether or not anything follows. That is why it ships at level: low. A hit means somebody read the clock. On its own that is barely a finding; it is worth something as context beside an alert that already exists.

02 · Telemetry you need

category: process_creation / product: windows, copied verbatim from AN0430, whose Windows source is Security EventID 4688. Two audit prerequisites, neither on by default: Audit Process Creation, and the separate Include command line in process creation events policy. The rule reads only CommandLine; without the second policy the field is blank and the rule matches nothing while validating and rendering perfectly. All four backends render.

03 · How the logic works

One selection, one field, nine CommandLine|contains terms, condition: selection. The whole selection is MITRE's CommandlineKeywordList knob — MITRE names the knob and offers w32tm /tz, net time \\host and Get-TimeZone as prose examples — written out as literals by the author. contains, not endswith, because these are argument fragments mid-line, not path suffixes. w32tm /tz and w32tm -tz are listed as two literals rather than using the windash modifier, which keeps the rendered Wazuh regex readable; same for tzutil /g and tzutil -g. w32tm /query /status is the full two-token form so a bare w32tm elsewhere does not match. Three terms deserve a hard look, and this is the most transferable lesson here. Get-TimeZone, [System.TimeZoneInfo] and Get-Date -Format are PowerShell script content, not process command lines. In category: process_creation they can appear only in the narrow powershell.exe -Command "..." inline form; every use inside a .ps1, a script block, an encoded command or an interactive session is invisible to this log source. They contribute almost no coverage while carrying most of the rule's false-positive load — and the brief hands the author the right home for them, AN0430's service: powershell source (4103/4104), where ScriptBlockText holds the cmdlet text. Matching a field against content that field never holds is a silent failure: it validates, it renders in four backends, and it finds nothing. One escaping note. 'net time \\' is two characters in the YAML, and Sigma treats \\ as one literal backslash — the rendered KQL is CommandLine contains "net time \". Here it is harmless, because net time \\dc01 still contains net time \, but the term is looser than intended. A genuine UNC prefix needs four backslashes in the YAML. The same construct is fatal elsewhere in this corpus, where a two-backslash "UNC prefix" degrades into "contains a backslash" and the selection becomes always true.

04 · Common false positives

Time-sync troubleshooting. w32tm /tz and w32tm /query /status are the
The reviewer's specific miss: **legacy logon scripts running
Get-Date -Format inside benign in-house PowerShell, where the time names a

05 · Detection maturity

tier_1: . Machine-derived from a MITRE scaffold containing no query logic, and never executed against a log line. It is honest about being precursor-only and correctly rated `low`, but neither its coverage nor its volume has been measured.
tier_2: verify the command-line audit policy is on, run the terms read-only, and count how much of the volume is one logon script. Then add `date /t` and `time /t` and see whether they appear — if they do, they were a real gap.
tier_3: ** pair it with a scheduled-task-creation rule under MITRE's TimeWindow knob so the alert fires on discovery-then-scheduling, and keep this rule itself as enrichment.

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Split the rule. Leave w32tm, tzutil and net time on process_creation;
Close the evasion gap. The commands an operator actually types are the missing
MITRE's AllowedParents and ProcessPrevalenceThreshold knobs are the levers
MITRE's TimeWindow knob is AN0430's second half — time discovery followed by
AN0430 also mentions the GetTickCount API. That is not a command line at all;

Declared by the author

Time-sync troubleshooting by administrators and support staff. w32tm /tz and w32tm /query /status are the documented first steps when a host drifts off the domain clock, so a burst of these around a Kerberos failure is expected.
Management agents, logon scripts and backup jobs that stamp a timestamp or read the time zone at every run. MITRE's AllowedParents and ProcessPrevalenceThreshold knobs exist precisely for this — baseline the recurring parent and drop the ones that fire estate-wide every day.
Get-Date -Format and Get-TimeZone inside benign in-house PowerShell, where the time is used to name a log file rather than to profile the host. This term is the weakest in the list; remove it first if the rule is too loud.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1124, evaluated against their process_creation events.

Share this rule

/u/siemphony/664bda20-d2a9-4bf8-a83e-9e19f4ca9578

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Detect system time and time zone discovery on the command line

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it