Windows System Time Modification

A subject modifies the Windows system time, time zone, or time synchronization behavior to obscure timestamps associated with local artifacts, event logs, file activity, process execution, or other evidence relevant to an insider threat investigation.

On Windows systems, this behavior may involve manual date and time changes, abuse of the “Change the system time” user right, modification of Windows Time service behavior, or use of administrative tooling to alter clock settings.