TA0003 · PERSISTENCE
Time Providers
Adversaries may abuse time providers to execute DLLs when the system boots. The Windows Time service (W32Time) enables time synchronization across and within domains.
Detect it with
Baseline values and monitor/analyze activity related to modifying W32Time information in the Registry, including application programming interface (API) calls such as RegCreateKeyEx and RegSetValueEx as well as execution of the W32tm.exe utility.
Why it matters on shift
Time Providers is one of the concrete ways adversaries achieve persistence. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After persistence, the next tactic is usually Privilege Escalation. Search your telemetry for the transition before closing the ticket.
Kill-chain context