DllName value written under a W32Time time provider subkey

Siemphony@siemphonyhighT1547.003unverified

Matches the registry write that arms a Windows time provider — a DllName value set under a subkey of Services\W32Time\TimeProviders — which is the value the time provider manager reads at service start to decide which DLL to load, and the half of MITRE's AN0341 that a single event can carry. The path gate is anchored on \Services\ deliberately: the Group Policy copy of this tree lives under SOFTWARE\Policies\Microsoft\W32time\TimeProviders, no DLL is ever loaded from there, and an unanchored match would fire on every policy refresh in the domain. The built-in NtpClient, NtpServer and VMICTimeProvider subkeys are not excluded, because overwriting an existing provider's DllName is as workable a persistence route as the new arbitrarily named subkey MITRE describes and produces an identical event. The rule is written in the Sysmon registry_set vocabulary, where TargetObject carries key path and value name as one string; Sysmon EventID 13 is not collected at all unless the deployed configuration includes this key, and the widely used community configurations do not, so an unprepared host returns zero rows for reasons unrelated to adversary activity. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0122, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceRegistryEvents| where (RegistryKey contains "\\Services\\W32Time\\TimeProviders\\" and RegistryKey endswith "\\DllName")

Splunk · SPL

Run this as a search.

index=* (TargetObject="*\\Services\\W32Time\\TimeProviders\\*" AND TargetObject="*\\DllName")

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(registry.path) LIKE "*\\\\services\\\\w32time\\\\timeproviders\\\\*" AND TO_LOWER(registry.path) LIKE "*\\\\dllname")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,registry_set,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="12">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="TargetObject" type="pcre2">(?i)\\Services\\W32Time\\TimeProviders\\</field>    <field name="TargetObject" type="pcre2">(?i)\\DllName$</field>    <description>DllName value written under a W32Time time provider subkey</description>    <mitre>      <id>T1547.003</id>    </mitre>  </rule></group>

At a glance

Logsource: registry_set / windows
Level: high
Category: registry_persistence
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 5ef58136-2603-46e1-a2cf-c78a051b18be

ATT&CKT1547.003

T1547.003Time Providers

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonregistry persistence

registry persistenceAI draft — unreviewed

01 · What this rule detects

AN0341 correlates three things: privileged registry key creation under W32Time's TimeProviders path, a new DLL written to disk, and follow-on process activity by LocalService. This rule takes only the first clause — a Sysmon registry_set event where TargetObject|contains: '\Services\W32Time\TimeProviders\' is ANDed with TargetObject|endswith: '\DllName'. It fires on the registry write that arms a time provider, before any DLL is confirmed on disk or loaded. Say the gap plainly: a hit is a DllName write, not proof a malicious DLL exists or ever loads. The write could point at a file that never lands, or at a legitimate provider being repaired.

02 · Telemetry you need

Sysmon EventID 13, category: registry_set / product: windows, copied verbatim from AN0341's first log source. Registry Key Modification is not collected in widely used community Sysmon configs unless the TimeProviders tree is explicitly included — an unprepared host returns zero rows for reasons unrelated to adversary activity, which the rule's description states. Sentinel has no table modelled for this logsource and refuses the rule; three of four backends render it.

03 · How the logic works

Two selections, implicitly ANDed. selection_key requires the TimeProviders path anywhere in TargetObject; selection_value requires the string to end in \DllName. Together they isolate exactly the value the time provider manager reads at service start. The \Services\ anchor is deliberate: the Group Policy mirror of this tree lives under SOFTWARE\Policies\Microsoft\W32time\TimeProviders, where no DLL is ever loaded, and an unanchored contains would fire on every policy refresh in the domain. The reviewer checked this shape specifically and confirmed it correct — including that anchoring on the literal Services segment, rather than the live control set (which Sysmon logs as ControlSet001, not CurrentControlSet), avoids a dead-arm trap that would validate clean and match nothing. The rule also does not exclude the built-in NtpClient, NtpServer or VMICTimeProvider subkeys — overwriting an existing provider's DllName is as workable a persistence route as registering a new one, and produces an identical event.

04 · Common false positives

The reviewer's largest finding: EventID 13 also carries a Details field holding the actual DLL path being written, and the rule never looks at it. Filtering out Details values ending in the two shipped provider DLLs (w32time.dll, vmictimeprovider.dll) would remove three of the four listed false positives outright — as written, a routine w32tm /unregister + w32tm /register repair and a Hyper-V integration-component install are indistinguishable from the attack.
The reviewer also flagged a missed false positive larger than any listed one: Windows servicing. Cumulative updates, in-place upgrades, and DISM/SFC component-store repairs re-register W32Time and rewrite DllName fleet-wide inside one maintenance window — a bigger burst than the third-party GPS/PTP software or sysprep-pipeline entries the rule already documents.

05 · Detection maturity

tier_1: . UNVERIFIED, derived from a MITRE scaffold with no query logic, never run against a log line.
tier_2: requires the `Details` filter above, then a read-only run through at least one patch cycle so servicing bursts surface and can be excluded by version or update context rather than guessed at.
tier_3: ** builds AN0341's dropped legs as companions — a file_event rule on the DLL path named in Details, and a LocalService process-activity check — joined under MITRE's TimeWindow so an alert means a provider was armed and used, not just written.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Add the Details-based negative filter the review specifies before
Treat MITRE's RegistryPathScope knob as already spent — the rule is
The neighbouring persistence route the reviewer flagged, `Services\W32Time\

Declared by the author

An administrator or helpdesk script repairing time synchronisation with w32tm /unregister followed by w32tm /register, which rewrites DllName for NtpClient and NtpServer and is the most likely benign hit this rule ever produces.
Hyper-V integration component installation and virtual machine template deployment, which registers VMICTimeProvider and writes its DllName as part of guest tooling setup.
Third-party time synchronisation products — GPS and PTP hardware clock software, NTP appliance agents — registering their own provider subkey with a vendor DLL at install time. This is structurally identical to the attack and cannot be separated from it on this event alone; MITRE's RegistryPathScope knob is the wrong place to narrow it, so the exclusion belongs on the installing process.
Image build, sysprep and specialisation pipelines that reset the time service on every new image, producing a burst of these writes on hosts that are about to be handed out.

Noise check0 of 6 fired

Fires on none of the 6 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 6 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1547.003, evaluated against their registry_set events.

Share this rule

/u/siemphony/5ef58136-2603-46e1-a2cf-c78a051b18be

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

DllName value written under a W32Time time provider subkey

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it