Discovery of a System Time — Detection Rule

Identifies use of various commands to query a systems time. This technique may be used before executing a scheduled task or to discover the time zone of a target system.

Read the full analysis on IntelFusions