Time Provider abuse (MITRE ATT&CK T1547.003) is a Windows persistence and privilege escalation technique. The Windows Time service (W32Time) synchronizes time across and within domains, and its time providers retrieve timestamps from hardware or network sources and pass them to clients.
How attackers use it
Time providers are DLLs registered in subkeys of HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\W32Time\TimeProviders\. The time provider manager, directed by the service control manager, loads the enabled ones at startup or when parameters change.
MITRE describes an adversary creating a new, arbitrarily named subkey whose DllName value points at a malicious DLL. Registration needs administrator privileges, but the DLL then runs as the Local Service account.
How to detect it
MITRE's strategy correlates three things: a privileged registry key creation under the TimeProviders path, a new DLL written to disk, and process activity by LocalService. Sysmon event IDs 11 (file created) and 13 (registry value set) are common sources.
How to reduce the risk
- Restrict registry permissions. Use Group Policy to block modifications to W32Time parameters in the registry.
- Restrict file permissions. Use Group Policy to block additions or changes to W32Time DLLs.
Quick check
Which value in a TimeProviders subkey points at the DLL?
DllName. A new subkey whose DllName points to an unexpected file is the pattern to investigate.
