Sigma rule: Unauthorized System Time Modification

Rule

Title

Unauthorized System Time Modification

Status

test

Level

low

Author

@neu5ron

Date

2019-02-05

Modified

2025-12-03

File

rules/windows/builtin/security/win_security_susp_time_modification.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detect scenarios where a potentially unauthorized application or user is modifying the system time.

Log source

product

windows

service

security

definition

Requirements: Audit Policy : System > Audit Security State Change, Group Policy : Computer Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\System\Audit Security State Change

Detection

selection:
    EventID: 4616
filter_main_svchost:
    ProcessName: 'C:\Windows\System32\svchost.exe'
    SubjectUserSid: 'S-1-5-19'
filter_optional_vmtools:
    ProcessName:
        - 'C:\Program Files\VMware\VMware Tools\vmtoolsd.exe'
        - 'C:\Program Files (x86)\VMware\VMware Tools\vmtoolsd.exe'
        - 'C:\Windows\System32\VBoxService.exe'
        - 'C:\Windows\System32\oobe\msoobe.exe'
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*

False positives (as the rule lists them)

• HyperV or other virtualization technologies with binary not listed in filter portion of detection

Tags

• attack.stealth
• attack.t1070.006

MITRE ATT&CK ids this rule names

• T1070.006

References

• Private Cuckoo Sandbox (from many years ago, no longer have hash, NDA as well)
• Live environment caused by malware
• https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4616

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/builtin/security/win_security_susp_time_modification.yml