Technique:  System Time Discovery
Agent Tesla can collect the timestamp from the victim’s machine.
AppleSeed can pull a timestamp from the victim's machine.
Astaroth collects the timestamp from the infected machine.
AvosLocker has checked the system time before and after encryption.
Azorult can collect the time zone information from the system.
BADHATCH can obtain the DATETIME from a compromised machine.
Bazar can collect the time on the compromised host.
BendyBear has the ability to determine local time on a compromised host.
Bisonal can check the system time set on the infected host.
BLUELIGHT can collect the local time on a compromised host.
It has used net time to check the local time on a target system.
build_downer has the ability to determine the local time to ensure malware installation only happens during the hours that the infected system is active.
During C0015, the threat actors used the command net view /all time to gather the local time of a compromised network.
Cannon can collect the current time zone information from the victim’s machine.
Carbon uses the command net time \127.0.0.1 to get information the system’s time.
ccf32 can determine the local time on targeted machines.
It has used time /t and net time \ip/hostname for system time discovery.
Clambling can determine the current time.
ComRAT has checked the victim system's date and time to perform tasks during business hours (9 to 5, Monday to Friday).
Conficker uses the current UTC victim system date for domain generation and connects to time servers to determine the current date.
Crimson has the ability to determine the date and time on a compromised host.
It malware can obtain system time from a compromised host.
DarkWatchman can collect the time zone information from the system.
DCSrv can compare the current time on an infected host with a configuration value to determine when to start the encryption process.
DRATzarus can use the GetTickCount and GetSystemTimeAsFileTime API calls to inspect system time.
Egregor contains functionality to query the local/system time.
Epic uses the net time command  to get the system time from the machine and collect the current date and time zone information.
EvilBunny has used the API calls NtQuerySystemTime, GetSystemTimeAsFileTime, and GetTickCount to gather time metrics as part of its checks to see if the malware is running in a sandbox.
FELIXROOT gathers the time zone information from the victim’s machine.
FunnyDream can check system time to help determine when changes were made to specified files.
GoldMax can check the current date-time value of the compromised system, comparing it to the hardcoded execution trigger and can send the current timestamp to the C2 server.
Grandoreiro can determine the time on the victim machine via IPinfo.
GravityRAT can obtain the date and time of a system.
Green Lambert can collect the date and time from a compromised host.
GRIFFON has used a reconnaissance module that can be used to retrieve the date and time of the system.
It used a function to gather the current time.
HOPLIGHT has been observed collecting system time from victim machines.
InvisiMole gathers the local system time from the victim’s machine.
KEYPLUG can obtain the current tick count of an infected computer.
A Destover-like implant used by It can obtain the current system time and send it to the C2 server.
Metamorfo uses JavaScript to get the system time.
MoonWind obtains the victim's current time.
The net time command can be used in Net to determine the local or remote system time.
NOKKI can collect the current timestamp of the victim's machine.
Okrum can obtain the date and time of the compromised system.
OopsIE checks to see if the system is configured with "Daylight" time and checks for a specific region to be set for the timezone.
During Operation CuckooBees, the threat actors used the net time command as part of their advanced reconnaissance.
During Operation Wocao, threat actors used the time command to retrieve the current time of a compromised system.
PipeMon can send time zone information from a compromised host to C2.
PowerDuke has commands to get the time the machine was built, the time, and the time zone.
As part of the data reconnaissance phase, Proxysvc grabs the system time to send back to the control server.
QakBot can identify the system time on a targeted host.
It can obtain the victim time zone.
ShadowPad has collected the current date and time of the victim system.
Shamoon obtains the system time and will only activate if it is greater than a preset date.
SHARPSTATS has the ability to identify the current date and time on the compromised host.
It has used tools to obtain the current system time.
SILENTTRINITY can collect start time information from a compromised host.
SombRAT can execute getinfo  to discover the current time on a compromised host.
StoneDrill can obtain the current date and time of the victim machine.
StrifeWater can collect the time zone from the victim's machine.
Stuxnet collects the time and date of a system when it is infected.
SVCReady can collect time zone information.
T9000 gathers and beacons the system time during installation.
Taidoor can use GetLocalTime and GetSystemTime to collect system time.
TAINTEDSCRIBE can execute GetLocalTime for time discovery.
TajMahal has the ability to determine local time on a compromised host.
It has checked the current date on the victim system.
Torisma can collect the current time on a victim machine.
It surveys a system upon check-in to discover the system time by using the net time command.
UPPERCUT has the capability to obtain the time zone information and current timestamp of the victim’s machine.
WindTail has the ability to generate the current date and time.
Zebrocy gathers the current time zone and date information from the system.
Zeus Panda collects the current system time (UTC) and sends it back to the C2 server.
ItM has used a tool to capture the time on a compromised host in order to register it with C2.