Boot or Logon Autostart Execution: Time Providers

Adversaries may abuse time providers to execute DLLs when the system boots. The Windows Time service (W32Time) enables time synchronization across and within domains. [1] W32Time time providers are responsible for retrieving time stamps from hardware/network resources and outputting these values to other network clients. [2]

Time providers are implemented as dynamic-link libraries (DLLs) that are registered in the subkeys of HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\W32Time\TimeProviders\. [2] The time provider manager, directed by the service control manager, loads and starts time providers listed and enabled under this key at system startup and/or whenever parameters are changed. [2]

Adversaries may abuse this architecture to establish persistence, specifically by registering and enabling a malicious DLL as a time provider. Administrator privileges are required for time provider registration, though execution will run in context of the Local Service account. [3]

ID: T1547.003
Sub-technique of:  T1547
Platforms: Windows
Permissions Required: Administrator, SYSTEM
Contributors: Scott Lundgren, @5twenty9, Carbon Black
Version: 1.0
Created: 24 January 2020
Last Modified: 25 March 2020
Provided by LAYER 8

Mitigations

ID Mitigation Description
M1022 Restrict File and Directory Permissions

Consider using Group Policy to configure and block additions/modifications to W32Time DLLs. [4]

M1024 Restrict Registry Permissions

Consider using Group Policy to configure and block modifications to W32Time parameters in the Registry. [4]

Detection

ID Data Source Data Component
DS0017 Command Command Execution
DS0011 Module Module Load
DS0009 Process Process Creation
DS0024 Windows Registry Windows Registry Key Modification

Baseline values and monitor/analyze activity related to modifying W32Time information in the Registry, including application programming interface (API) calls such as RegCreateKeyEx and RegSetValueEx as well as execution of the W32tm.exe utility. [4] There is no restriction on the number of custom time providers registrations, though each may require a DLL payload written to disk. [3]

The Sysinternals Autoruns tool may also be used to analyze auto-starting locations, including DLLs listed as time providers. [5]

References