TACTIC: DISCOVERY
System Time Discovery (T1124): Real Cases
MITRE Definition ↗ Adversaries check system time and timezone to synchronize distributed intrusion events.
Key Facts
Technique ID
T1124
Discovery
Mapped Cases
1
Primary sources
Related Laws
2
Criminal statutes
- ATT&CK Technique Identifier: T1124.
- Tactical Phase: Discovery.
- Substantiated in 1 primary court prosecution and advisory cases.
- Linked records cite judicial dockets, plea agreements, or federal advisories.
Verified Evidentiary Case Records (1)
U.S. v. Andrienko et al. (Sandworm / GRU Unit 74455)
fugitive 2020-10-15
Six Russian Main Intelligence Directorate (GRU) military officers charged with deploying the NotPetya wiper, Olympic Destroyer malware, KillDisk attacks against Ukrainian power grids, and cyberattacks targeting French elections.
Primary Source Evidence Excerpt: CISA Advisory AA17-181A
"NotPetya scheduled a forced system reboot via shutdown.exe /r /t 60 synchronized to local system clock timestamps."
U.S. District Court for the Western District of Pennsylvania · 2:20-cr-00316
View full case dossier →
Commonly Charged Criminal Statutes
18 U.S.C. § 1030(a)(5)(A)
Intentional Damage to a Protected Computer
Prohibits knowingly causing the transmission of a program, information, code, or command that intentionally causes damage without authorization to a protected computer.
18 U.S.C. § 1030(b)
Conspiracy to Commit Computer Fraud
Punishes any person who conspires to commit or attempts to commit any computer fraud offense under section 1030.