T1124: System Time Discovery
An adversary may gather the system time and/or time zone settings from a local or remote system. The system time is set and stored by services, such as the Windows Time Service on Windows or systemsetup on macOS.CitationMSDN System TimeCitationTechnet Windows Time ServiceCitationsystemsetup mac time These time settings may also be synchronized between systems and services in an enterprise network, typically accomplished with a network time server within a domain.CitationMac Time SyncCitationlinux system time
System time information may be gathered in a number of ways, such as with Net on Windows by performing net time \\hostname to gather the system time on a remote system. The victim's time zone may also be inferred from the current system time or gathered by using w32tm /tz.CitationTechnet Windows Time Service In addition, adversaries can discover device uptime through functions such as GetTickCount() to determine how long it has been since the system booted up.CitationVirtualization/Sandbox Evasion
On network devices, Network Device CLI commands such as `show clock detail` can be used to see the current time configuration.Citationshow_clock_detail_cisco_cmd On ESXi servers, `esxcli system clock get` can be used for the same purpose.
In addition, system calls – such as time() – have been used to collect the current time on Linux devices.CitationMAGNET GOBLIN On macOS systems, adversaries may use commands such as systemsetup -gettimezone or timeIntervalSinceNow to gather current time zone information or current date and time.CitationSystem Information Discovery TechniqueCitationESET DazzleSpy Jan 2022
This information could be useful for performing other techniques, such as executing a file with a Scheduled Task/JobCitationRSA EU12 They're Inside, or to discover locality information based on time zone to assist in victim targeting (i.e. System Location Discovery). Adversaries may also use knowledge of system time as part of a time bomb, or delaying execution until a specified date/time.CitationAnyRun TimeBomb
Security context for executives and security teams
System Time Discovery is usually a small discovery action, but it can matter because timing is often part of an intrusion plan. An attacker may check local or remote time, time zone, or uptime to schedule later activity, infer victim locality, avoid analysis, or align follow-on actions such as scheduled tasks. For leaders, this is not a standalone “high-severity” behavior; it is a context signal that becomes important when paired with other discovery, execution, persistence, or lateral movement activity.
Executive priority
Prioritize this technique as part of intrusion correlation and response readiness rather than as a control problem to solve in isolation. Executives should ask whether SOC and IR teams can reconstruct time-based attacker behavior across Windows, Linux, macOS, ESXi, and network devices, and whether logs are time-synchronized enough to support investigations, audit evidence, and incident decisions. The relationship set shows this behavior appears across espionage, ransomware, and RAT/backdoor contexts, so it is useful for detection chaining even though it is common and often benign.
Technical view
Validate platform-aware visibility for commands and APIs referenced by ATT&CK: Windows examples include `net time \\hostname` and `w32tm /tz`; macOS includes `systemsetup -gettimezone`; network devices may show commands such as `show clock detail`; ESXi may show `esxcli system clock get`; Linux activity may involve system calls such as `time()`. Because MITRE provides no official detection text for T1124, use DET0151’s relationship as support for a behavior-chain strategy: treat time discovery as weak on its own but stronger when adjacent to scheduled task/job creation, system/location discovery, sandbox-evasion-like timing checks, remote host enumeration, or malware/backdoor execution relationships.
Likely telemetry
- Endpoint process creation and command-line telemetry for Windows, Linux, macOS, and ESXi administrative shells
- Windows command usage involving Net and Windows Time Service tooling where collected
- macOS command execution logs for `systemsetup` where available
- Linux shell history, audit, or EDR telemetry that can show time-related commands or suspicious process context
- Network device command accounting/CLI logs for clock-detail queries
Detection direction
- Do not alert on time queries alone without context; administrators, scripts, monitoring tools, and troubleshooting workflows commonly check system time.
- Tune for unusual parent processes, remote targets, rare users, post-compromise tooling, or time discovery occurring immediately before scheduled task/job activity or other discovery behaviors.
- Create platform-specific detections for the named command patterns, then suppress known-good administrative automation.
- For network devices and ESXi, confirm that management-plane and CLI logging are actually ingested; these platforms are common blind spots compared with standard endpoint telemetry.
- Use the ATT&CK relationships as hunting context: related campaigns, groups, and software indicate the behavior is used by diverse intrusion types, but those relationships do not prove local exposure or current activity.
Mitigation priorities
- Maintain accurate, centralized time synchronization so investigations and compliance evidence are reliable.
- Restrict and monitor remote administrative access to systems, ESXi hosts, and network devices where time information can be queried remotely.
- Apply least-privilege administration and command/accountability logging for device CLIs and operating-system management tools.
- Focus prevention effort on higher-value adjacent behaviors, such as unauthorized scheduled task/job creation, remote execution, and persistence, rather than trying to block ordinary time reads.
- Include time-discovery checks in incident-response playbooks as a correlation clue, especially when delayed execution or locality targeting is suspected.
Additional notes and limits
T1124 is a discovery technique across ESXi, Linux, macOS, network devices, and Windows. Its value is mostly analytic: it can help explain attacker timing, targeting, sandbox evasion, or staging behavior. The supplied relationships include DET0151 and multiple campaigns, groups, and software entries, supporting use in threat-informed detection engineering without implying current exploitation in any specific environment.
MITRE does not provide official detection or mitigation text for this object in the supplied fields. Local baselines are required because legitimate time checks are common. API-level time checks may not be visible in many environments, and network device or ESXi telemetry may be absent unless specifically configured.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
System Time Discovery
An adversary may gather the system time and/or time zone settings from a local or remote system. The system time is set and stored by services, such as the Windows Time Service on Windows or systemsetup on macOS.CitationMSDN System TimeCitationTechnet Windows Time ServiceCitationsystemsetup mac time These time settings may also be synchronized between systems and services in an enterprise network, typically accomplished with a network time server within a domain.CitationMac Time SyncCitationlinux system time
System time information may be gathered in a number of ways, such as with Net on Windows by performing net time \\hostname to gather the system time on a remote system. The victim's time zone may also be inferred from the current system time or gathered by using w32tm /tz.CitationTechnet Windows Time Service In addition, adversaries can discover device uptime through functions such as GetTickCount() to determine how long it has been since the system booted up.CitationVirtualization/Sandbox Evasion
On network devices, Network Device CLI commands such as `show clock detail` can be used to see the current time configuration.Citationshow_clock_detail_cisco_cmd On ESXi servers, `esxcli system clock get` can be used for the same purpose.
In addition, system calls – such as time() – have been used to collect the current time on Linux devices.CitationMAGNET GOBLIN On macOS systems, adversaries may use commands such as systemsetup -gettimezone or timeIntervalSinceNow to gather current time zone information or current date and time.CitationSystem Information Discovery TechniqueCitationESET DazzleSpy Jan 2022
This information could be useful for performing other techniques, such as executing a file with a Scheduled Task/JobCitationRSA EU12 They're Inside, or to discover locality information based on time zone to assist in victim targeting (i.e. System Location Discovery). Adversaries may also use knowledge of system time as part of a time bomb, or delaying execution until a specified date/time.CitationAnyRun TimeBomb
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
All related ATT&CK context
No relationships are available in the current normalized data for this object.
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.