Time Provider DLL Registered for Persistence

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•1

This rule detects network traffic on port 445 (SMB) containing the string "TimeProviders" (case-insensitive). This pattern is indicative of a Time Provider DLL being registered for persistence, a technique used by attackers to maintain access to a system. The rule specifically looks for this activity in established TCP connections flowing to the home network.