Atomic Red Team doc generator
78 lines
2.8 KiB
YAML
78 lines
2.8 KiB
YAML
attack_technique: T1124
|
|
display_name: System Time Discovery
|
|
atomic_tests:
|
|
- name: System Time Discovery
|
|
auto_generated_guid: 20aba24b-e61f-4b26-b4ce-4784f763ca20
|
|
description: |
|
|
Identify the system time. Upon execution, the local computer system time and timezone will be displayed.
|
|
supported_platforms:
|
|
- windows
|
|
input_arguments:
|
|
computer_name:
|
|
description: computer name to query
|
|
type: string
|
|
default: localhost
|
|
executor:
|
|
command: |
|
|
net time \\#{computer_name}
|
|
w32tm /tz
|
|
name: command_prompt
|
|
- name: System Time Discovery - PowerShell
|
|
auto_generated_guid: 1d5711d6-655c-4a47-ae9c-6503c74fa877
|
|
description: |
|
|
Identify the system time via PowerShell. Upon execution, the system time will be displayed.
|
|
supported_platforms:
|
|
- windows
|
|
executor:
|
|
command: |
|
|
Get-Date
|
|
name: powershell
|
|
- name: System Time Discovery in FreeBSD/macOS
|
|
auto_generated_guid: f449c933-0891-407f-821e-7916a21a1a6f
|
|
description: |
|
|
Identify system time. Upon execution, the local computer system time and timezone will be displayed.
|
|
supported_platforms:
|
|
- linux
|
|
- macos
|
|
executor:
|
|
command: |
|
|
date
|
|
name: sh
|
|
- name: System Time Discovery W32tm as a Delay
|
|
auto_generated_guid: d5d5a6b0-0f92-42d8-985d-47aafa2dd4db
|
|
description: |
|
|
identifies DCRat delay time tactics using w32tm.
|
|
https://research.splunk.com/endpoint/b2cc69e7-11ba-42dc-a269-59c069a48870/
|
|
https://blogs.blackberry.com/en/2022/05/dirty-deeds-done-dirt-cheap-russian-rat-offers-backdoor-bargains
|
|
supported_platforms:
|
|
- windows
|
|
executor:
|
|
command: |
|
|
W32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
|
|
name: command_prompt
|
|
- name: System Time with Windows time Command
|
|
auto_generated_guid: 53ead5db-7098-4111-bb3f-563be390e72e
|
|
description: |
|
|
Displays the current system time via the Windows builtin time command: https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/time
|
|
Recently observed in use in the wild during an incident involving Ursnif malware:
|
|
https://github.com/The-DFIR-Report/Sigma-Rules/blob/dc72f0b557fc63347379be0a33439788256761c8/rules/windows/process_creation/proc_creation_win_system_time_lookup.yml
|
|
https://thedfirreport.com/2023/01/09/unwrapping-ursnifs-gifts/
|
|
supported_platforms:
|
|
- windows
|
|
executor:
|
|
command: |
|
|
time
|
|
name: command_prompt
|
|
- name: Discover System Time Zone via Registry
|
|
auto_generated_guid: 25c5d1f1-a24b-494a-a6c5-5f50a1ae7f47
|
|
description: |
|
|
Identify the Operating System Time Zone via registry with the reg.exe command.
|
|
Upon execution, the system Time Zone will be shown.
|
|
supported_platforms:
|
|
- windows
|
|
executor:
|
|
command: |
|
|
reg query "HKLM\SYSTEM\CurrentControlSet\Control\TimeZoneInformation" /v TimeZoneKeyName
|
|
name: command_prompt
|
|
elevation_required: false
|