Techniques › T1124 › AN0434
AN0434 Analytic 0434
Network Devices · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Non-standard or rare users/locations issue CLI commands like "show clock detail" or "show timezone"; optionally followed by configuration of time/timezone or NTP sources. AAA/TACACS+ accounting and syslog correlate execution to identity, source IP, and privilege level.</p>
- Detects
- T1124 System Time Discovery
- Part of
- DET0151 Behavior-chain, platform-aware detection strategy for T1124 System Time Discovery
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| networkdevice:syslog | command-exec: CLI commands containing "show clock", "show clock detail", "show timezone" executed by suspicious user/source | DC0064 Command Execution |
| networkdevice:config | config-change: timezone or ntp server configuration change after a time query command | DC0061 File Modification |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
AllowedAdminSubnets | Only alert on access from outside the NOC/management subnets. |
KnownMaintenanceUsers | Whitelist known automation/orchestration accounts. |
TimeWindow | Correlation window between time query and config change. |