Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1124_system-time-discovery
An adversary may gather the system time and/or time zone settings from a local or remote system.
Passed 21 of 22 test cases with the skill, and 19 of 22 without it.
2 fixed19 passed either way1 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 2 test cases the skill fixed. Same model, same prompt, with and without the skill.
An incident response team is investigating suspicious shell activity on a VMware ESXi hypervisor host. An analyst asserts ESXi time settings can only be checked via vSphere Client web interface. What exact esxcli command namespace and subcommand retrieve current host system clock settings from the CLI?
| Checked | Without skill | With skill |
|---|---|---|
| The response identifies esxcli system clock get as the command for reading ESXi system time. | Missed | Passed |
The instructions your model reads when the skill loads.
An adversary may gather the system time and/or time zone settings from a local or remote system. The system time is set and stored by services, such as the Windows Time Service on Windows or systemsetup on macOS. These time settings may also be synchronized between systems and services in an enterprise network, typically accomplished with a network time server within a domain.
System time information may be gathered in a number of ways, such as with Net on Windows by performing net time \hostname to gather the system time on a remote system. The victim's time zone may also be inferred from the current system time or gathered by using w32tm /tz. In addition, adversaries can discover device uptime through functions such as GetTickCount() to determine how long it has been since the system booted up.
On network devices, Network Device CLI commands such as show clock detail can be used to see the current time configuration. On ESXi servers, esxcli system clock get can be used for the same purpose.
In addition, system calls – such as time() – have been used to collect the current time on Linux devices. On macOS systems, adversaries may use commands such as systemsetup -gettimezone or timeIntervalSinceNow to gather current time zone information or current date and time.
This information could be useful for performing other techniques, such as executing a file with a Scheduled Task/Job, or to discover locality information based on time zone to assist in victim targeting (i.e. System Location Discovery). Adversaries may also use knowledge of system time as part of a time bomb, or delaying execution until a specified date/time.
Platforms: ESXi, Linux, macOS, Network Devices, Windows
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Identify the system time. Upon execution, the local computer system time and timezone will be displayed.
Supported Platforms: windows
test cases passed, vs 19 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.