CmdID

CmdID / Commands

w32tm

Query and control the w32time time synchronization service. tldr-pages

On Windows 2 Sigma rules name it File w32tm.exe

Opens CmdID with your command. It is read in your browser and sent nowhere.

Windows

from tldr-pages, CC BY 4.0

Show the current status of time synchronization

w32tm /query /status /verboseIdentify

Show a time offset graph against a time server

w32tm /stripchart /computer:time_serverIdentify

Show an NTP reply from a time server

w32tm /stripchart /packetinfo /samples:1 /computer:time_serverIdentify

Show the state of the currently used time servers

w32tm /query /peersIdentify

Show configuration of the w32time service (run in elevated console)

w32tm /query /configurationIdentify

Force time resynchronization immediately (run in elevated console)

w32tm /resync /forceIdentify

Write w32time debug logs into a file (run in elevated console)

w32tm /debug /enable /file:path\to\debug.log /size:10000000 /entries:0-300Identify

What detects it

Sigma process creation rules that name w32tm
highUse of W32tm as Timerfrack113
lowDiscovery of a System TimeE.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community