Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7 detections
Filters
Last updated
All Time
Detection languages
4
1
1
1
Contributors
2
2
2
1
Categories
5
2
1
1
Platforms
6
1
Products / Services
2
1
1
1
1
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
IDS Classtypes
1
IDS Protocols
1
Detects registration of malicious time provider DLLs for SYSTEM persistence
This rule detects network traffic on port 445 (SMB) containing the string "TimeProviders" (case-insensitive). This pattern is indicative of a Time Provider DLL being registered for persistence, a technique used by attackers to maintain access to a system. The rule specifically looks for this activity in established TCP connections flowing to the home network.
Detects processes setting a new DLL in DllName in under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProvider.
Adversaries may abuse time providers to execute DLLs when the system boots.
The Windows Time service (W32Time) enables time synchronization across and within domains.
Adversaries may abuse time providers to execute DLLs when the system boots.
The Windows Time service (W32Time) enables time synchronization across and within domains.
Detects processes setting a new DLL in DllName in under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProvider.
Adversaries may abuse time providers to execute DLLs when the system boots.
The Windows Time service (W32Time) enables time synchronization across and within domains.
Adversaries may abuse time providers to execute DLLs when the system boots.
The Windows Time service (W32Time) enables time synchronization across and within domains.
The following analytic detects suspicious modifications to the time provider registry for persistence and autostart. It leverages data from the Endpoint.Registry data model, focusing on changes to the "CurrentControlSet\\Services\\W32Time\\TimeProviders" registry path. This activity is significant because such modifications are uncommon and can indicate an attempt to establish persistence on a compromised host. If confirmed malicious, this technique allows an attacker to maintain access and execute code automatically upon system boot, potentially leading to further exploitation and control over the affected system.
This rule detects the creation or modification of a DLL path within the Windows Time service (W32Time) TimeProviders registry key. Adversaries may abuse this mechanism to establish persistence by registering a malicious DLL to be loaded and executed when the system boots. The rule specifically looks for changes to the 'DllName' value under 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders' and filters out known legitimate DLLs associated with the W32Time service.
Detects processes setting a new DLL in DllName in under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProvider.
Adversaries may abuse time providers to execute DLLs when the system boots.
The Windows Time service (W32Time) enables time synchronization across and within domains.
Adversaries may abuse time providers to execute DLLs when the system boots.
The Windows Time service (W32Time) enables time synchronization across and within domains.