TA0007 · DISCOVERY
System Time Discovery
An adversary may gather the system time and/or time zone settings from a local or remote system. The system time is set and stored by services, such as the Windows Time Service on Windows or systemsetup on macOS.
Detect it with
Command-line interface monitoring may be useful to detect instances of net.exe or other command-line utilities being used to gather system time or time zone.
Why it matters on shift
System Time Discovery is one of the concrete ways adversaries achieve discovery. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After discovery, the next tactic is usually Lateral Movement. Search your telemetry for the transition before closing the ticket.
Kill-chain context