T1124 System Time Discovery
An adversary may gather the system time and/or time zone settings from a local or remote system. MITRE ATT&CK
2 Sigma rules T1124 on attack.mitre.org
Sigma rules tagged with it
Command lines CmdID reads as it
To set the sign-in time from 8 AM to 5 PM for the username MikeD using 24-hour notation, run the following command on the page for net user
net user miked /time:M-F,08:00-17:00IdentifyTo set the sign-in time from 8 AM to 5 PM for MikeD using 12-hour notation, run the following command on the page for net user
net user miked /time:M-F,8AM-5PMIdentifyTo specify sign-in hours of 4 AM to 12 PM on Monday, 12 PM to 8 PM on Tuesday, and 8 AM to 5 PM Wednesday through Friday for username AnibalS, run the following command on the page for net user
net user anibals /time:M,4AM-12PM;T,12PM-8PM;W-F,8AM-5PMIdentifyAn example is here when CmdID’s reading of it names T1124: a Sigma rule it trips is tagged with it, or its abuse is documented as it.