Boot or Logon Autostart Execution: Time Providers
- ID
- T1547.003
- Tactics
- TA0003 Persistence, TA0004 Privilege Escalation
- Sub-technique of
- T1547 Boot or Logon Autostart Execution
- Platforms
- Windows
- Data sources
- Windows Registry Key Modification, File Creation, Module Load, Process Creation
- Source
- attack.mitre.org
- MITRE last modified
- 25 Oct 2025
Adversaries may abuse time providers to execute DLLs when the system boots. The Windows Time service (W32Time) enables time synchronization across and within domains.[2] W32Time time providers are responsible for retrieving time stamps from hardware/network resources and outputting these values to other network clients.[3]
Time providers are implemented as dynamic-link libraries (DLLs) that are registered in the subkeys of HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\W32Time\TimeProviders\.[3] The time provider manager, directed by the service control manager, loads and starts time providers listed and enabled under this key at system startup and/or whenever parameters are changed.[3]
Adversaries may abuse this architecture to establish persistence, specifically by creating a new arbitrarily named subkey pointing to a malicious DLL in the DllName value. Administrator privileges are required for time provider registration, though execution will run in context of the Local Service account.[4]
Detection
- DET0122 Detect Abuse of Windows Time Providers for Persistence
Data components: Windows Registry Key Modification, File Creation, Module Load, Process Creation
Mitigations (2)
- M1022 Restrict File and Directory Permissions
Consider using Group Policy to configure and block additions/modifications to W32Time DLLs. [1]
- M1024 Restrict Registry Permissions
Consider using Group Policy to configure and block modifications to W32Time parameters in the Registry. [1]