Adversaries may abuse time providers to execute DLLs when the system boots. The Windows Time service (W32Time) enables time synchronization across and within domains.[1] W32Time time providers are responsible for retrieving time stamps from hardware/network resources and outputting these values to other network clients.[2]
Time providers are implemented as dynamic-link libraries (DLLs) that are registered in the subkeys of HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\W32Time\TimeProviders\.[2] The time provider manager, directed by the service control manager, loads and starts time providers listed and enabled under this key at system startup and/or whenever parameters are changed.[2]
Adversaries may abuse this architecture to establish persistence, specifically by creating a new arbitrarily named subkey pointing to a malicious DLL in the DllName value. Administrator privileges are required for time provider registration, though execution will run in context of the Local Service account.[3]
| ID | Mitigation | Description |
|---|---|---|
| M1022 | Restrict File and Directory Permissions |
Consider using Group Policy to configure and block additions/modifications to W32Time DLLs. [4] |
| M1024 | Restrict Registry Permissions |
Consider using Group Policy to configure and block modifications to W32Time parameters in the Registry. [4] |
| ID | Data Source | Data Component | Detects |
|---|---|---|---|
| DS0017 | Command | Command Execution |
Monitor executed commands and arguments that may abuse time providers to execute DLLs when the system boots. |
| DS0011 | Module | Module Load |
There is no restriction on the number of custom time providers registrations, though each may require a DLL payload written to disk. [3] |
| DS0009 | Process | Process Creation |
Monitor newly executed processes, such as the W32tm.exe utility. [4] The Sysinternals Autoruns tool may also be used to analyze auto-starting locations, including DLLs listed as time providers. [5] |
| DS0024 | Windows Registry | Windows Registry Key Modification |
Monitor for changes made to windows registry keys and/or values modifying W32Time information in the Registry. |