Detectionhightest
Use of W32tm as Timer
When configured with suitable command line arguments, w32tm can act as a delay mechanism
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Log Source
WindowsProcess Creation
ProductWindows← raw: windows
CategoryProcess Creation← raw: process_creation
Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.
Detection Logic
Detection Logic2 selectors
detection:
selection_w32tm:
- Image|endswith: '\w32tm.exe'
- OriginalFileName: 'w32time.dll'
selection_cmd:
CommandLine|contains|all:
- '/stripchart'
- '/computer:'
- '/period:'
- '/dataonly'
- '/samples:'
condition: all of selection_*False Positives
Legitimate use
MITRE ATT&CK
Tactics
Techniques
Rule Metadata
Rule ID
6da2c9f5-7c53-401b-aacb-92c040ce1215
Status
test
Level
high
Type
Detection
Created
Sun Sep 25
Author
Path
rules/windows/process_creation/proc_creation_win_w32tm.yml
Raw Tags
attack.discoveryattack.t1124