Rule Info
Name
System Time Synchronization With Domain Controller via Net.exe
Author
Swachchhanda Shrawan Poudel (Nextron Systems)
Description
Detects use of net.exe to query and set the local system time from a domain controller.
Attackers may use this to reset system time after deliberate manipulation, to align clocks for Kerberos-based attacks, or to cover traces of time-based tampering.
Date
2026-06-02 00:00:00
Modified
None
Id
7c4f9d1e-32ba-4a87-b5c8-d91e603f7a52
Tags
attack.discovery attack.t1124
Type
Nextron Sigma feed only (private)
Rule History
Scan your endpoints, forensic images or collected files with our portable scanner THOR