Try it using Invoke-Atomic

System Time Discovery

Description from ATT&CK

An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network. (Citation: MSDN System Time) (Citation: Technet Windows Time Service)

System time information may be gathered in a number of ways, such as with Net on Windows by performing <code>net time \hostname</code> to gather the system time on a remote system. The victim's time zone may also be inferred from the current system time or gathered by using <code>w32tm /tz</code>. (Citation: Technet Windows Time Service)

This information could be useful for performing other techniques, such as executing a file with a Scheduled Task/Job (Citation: RSA EU12 They're Inside), or to discover locality information based on time zone to assist in victim targeting (i.e. System Location Discovery). Adversaries may also use knowledge of system time as part of a time bomb, or delaying execution until a specified date/time.(Citation: AnyRun TimeBomb) https://www.aleksandrhovhannisyan.com/blog/how-to-add-a-copy-to-clipboard-button-to-your-jekyll-blog/

Atomic Tests

Atomic Test #1 - System Time Discovery

Identify the system time. Upon execution, the local computer system time and timezone will be displayed.

Supported Platforms: windows

auto_generated_guid: 20aba24b-e61f-4b26-b4ce-4784f763ca20

Inputs:

Name Description Type Default Value
computer_name computer name to query string localhost

Attack Commands: Run with command_prompt!

1
2
3
net time \\#{computer_name}
w32tm /tz

Atomic Test #2 - System Time Discovery - PowerShell

Identify the system time via PowerShell. Upon execution, the system time will be displayed.

Supported Platforms: windows

auto_generated_guid: 1d5711d6-655c-4a47-ae9c-6503c74fa877

Inputs:

None

Attack Commands: Run with powershell!

1
2
Get-Date

source