An adversary may gather the system time and/or time zone settings from a local or remote system. The system time is set and stored by services, such as the Windows Time Service on Windows or <code>systemsetup</code> on macOS.(Citation: MSDN System Time)(Citation: Technet Windows Time Service)(Citation: systemsetup mac time) These time settings may also be synchronized between systems and services in an enterprise network, typically accomplished with a network time server within a domain.(Citation: Mac Time Sync)(Citation: linux system time)

System time information may be gathered in a number of ways, such as with [Net](https://attack.mitre.org/software/S0039) on Windows by performing <code>net time \\hostname</code> to gather the system time on a remote system. The victim's time zone may also be inferred from the current system time or gathered by using <code>w32tm /tz</code>.(Citation: Technet Windows Time Service) In addition, adversaries can discover device uptime through functions such as <code>GetTickCount()</code> to determine how long it has been since the system booted up.(Citation: Virtualization/Sandbox Evasion)

On network devices, [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `show clock detail` can be used to see the current time configuration.(Citation: show_clock_detail_cisco_cmd)

In addition, system calls – such as <code>time()</code> – have been used to collect the current time on Linux devices.(Citation: MAGNET GOBLIN) On macOS systems, adversaries may use commands such as <code>systemsetup -gettimezone</code> or <code>timeIntervalSinceNow</code> to gather current time zone information or current date and time.(Citation: System Information Discovery Technique)(Citation: ESET DazzleSpy Jan 2022)

This information could be useful for performing other techniques, such as executing a file with a [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053)(Citation: RSA EU12 They're Inside), or to discover locality information based on time zone to assist in victim targeting (i.e. [System Location Discovery](https://attack.mitre.org/techniques/T1614)). Adversaries may also use knowledge of system time as part of a time bomb, or delaying execution until a specified date/time.(Citation: AnyRun TimeBomb)
System Time Discovery
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1124  external_id: T1124     source_name: systemsetup mac time  description: Apple Support. (n.d.). About systemsetup in Remote Desktop. Retrieved March 27, 2024.  url: https://support.apple.com/en-gb/guide/remote-desktop/apd95406b8d/mac     source_name: linux system time  description: ArchLinux. (2024, February 1). System Time. Retrieved March 27, 2024.  url: https://wiki.archlinux.org/title/System_time     source_name: MAGNET GOBLIN  description: Check Point Research. (2024, March 8). MAGNET GOBLIN TARGETS PUBLICLY FACING SERVERS USING 1-DAY VULNERABILITIES. Retrieved March 27, 2024.  url: https://research.checkpoint.com/2024/magnet-goblin-targets-publicly-facing-servers-using-1-day-vulnerabilities/     source_name: show_clock_detail_cisco_cmd  description: Cisco. (2023, March 6). show clock detail - Cisco IOS Security Command Reference: Commands S to Z . Retrieved July 13, 2022.  url: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/s1/sec-s1-cr-book/sec-cr-s2.html#wp1896741674     source_name: Mac Time Sync  description: Cone, Matt. (2021, January 14). Synchronize your Mac's Clock with a Time Server. Retrieved March 27, 2024.  url: https://www.macinstruct.com/tutorials/synchronize-your-macs-clock-with-a-time-server/     source_name: ESET DazzleSpy Jan 2022  description: M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.  url: https://www.welivesecurity.com/2022/01/25/watering-hole-deploys-new-macos-malware-dazzlespy-asia/     source_name: AnyRun TimeBomb  description: Malicious History. (2020, September 17). Time Bombs: Malware With Delayed Execution. Retrieved April 22, 2021.  url: https://any.run/cybersecurity-blog/time-bombs-malware-with-delayed-execution/     source_name: Technet Windows Time Service  description: Mathers, B. (2016, September 30). Windows Time Service Tools and Settings. Retrieved November 25, 2016.  url: https://technet.microsoft.com/windows-server-docs/identity/ad-ds/get-started/windows-time-service/windows-time-service-tools-and-settings     source_name: MSDN System Time  description: Microsoft. (n.d.). System Time. Retrieved November 25, 2016.  url: https://msdn.microsoft.com/ms724961.aspx     source_name: RSA EU12 They're Inside  description: Rivner, U., Schwartz, E. (2012). They’re Inside… Now What?. Retrieved November 25, 2016.  url: https://www.rsaconference.com/writable/presentations/file_upload/ht-209_rivner_schwartz.pdf     source_name: System Information Discovery Technique  description: YUCEEL, Huseyin Can. Picus Labs. (2022, June 9). The System Information Discovery Technique Explained - MITRE ATT&CK T1082. Retrieved March 27, 2024.  url: https://www.picussecurity.com/resource/the-system-information-discovery-technique-explained-mitre-attack-t1082     source_name: Virtualization/Sandbox Evasion  description: YUCEEL, Huseyin Can. Picus Labs. (2022, June 9). Virtualization/Sandbox Evasion - How Attackers Avoid Malware Analysis. Retrieved December 26, 2023.  url: https://www.picussecurity.com/resource/virtualization/sandbox-evasion-how-attackers-avoid-malware-analysis     