2019-02-05 23:56:24 +00:00
|
|
|
title: Unauthorized System Time Modification
|
2019-11-12 22:12:27 +00:00
|
|
|
id: faa031b5-21ed-4e02-8881-2591f98d82ed
|
2019-02-05 23:56:24 +00:00
|
|
|
status: experimental
|
|
|
|
|
description: Detect scenarios where a potentially unauthorized application or user is modifying the system time.
|
|
|
|
|
author: '@neu5ron'
|
|
|
|
|
references:
|
|
|
|
|
- Private Cuckoo Sandbox (from many years ago, no longer have hash, NDA as well)
|
|
|
|
|
- Live environment caused by malware
|
|
|
|
|
date: 2019/02/05
|
2020-01-27 13:30:09 +00:00
|
|
|
midified: 2020/01/27
|
2019-02-05 23:56:24 +00:00
|
|
|
tags:
|
2019-03-06 04:25:12 +00:00
|
|
|
- attack.defense_evasion
|
2020-08-24 23:09:17 +00:00
|
|
|
- attack.t1099 # an old one
|
2020-07-14 15:53:32 +00:00
|
|
|
- attack.t1070.006
|
2019-02-05 23:56:24 +00:00
|
|
|
logsource:
|
|
|
|
|
product: windows
|
|
|
|
|
service: security
|
|
|
|
|
definition: 'Requirements: Audit Policy : System > Audit Security State Change, Group Policy : Computer Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\System\Audit Security State Change'
|
|
|
|
|
detection:
|
|
|
|
|
selection:
|
|
|
|
|
EventID: 4616
|
|
|
|
|
filter1:
|
|
|
|
|
ProcessName: 'C:\Program Files\VMware\VMware Tools\vmtoolsd.exe'
|
|
|
|
|
filter2:
|
2019-02-09 08:19:40 +00:00
|
|
|
ProcessName: 'C:\Windows\System32\VBoxService.exe'
|
2019-02-05 23:56:24 +00:00
|
|
|
filter3:
|
2019-02-09 08:19:40 +00:00
|
|
|
ProcessName: 'C:\Windows\System32\svchost.exe'
|
|
|
|
|
SubjectUserSid: 'S-1-5-19'
|
2019-02-05 23:56:24 +00:00
|
|
|
condition: selection and not ( filter1 or filter2 or filter3 )
|
|
|
|
|
falsepositives:
|
|
|
|
|
- HyperV or other virtualization technologies with binary not listed in filter portion of detection
|
2020-01-27 13:30:09 +00:00
|
|
|
level: medium
|
