macOS System Time Modification

A subject modifies the macOS system date, time, time zone, network time configuration, or time server settings to obscure the chronology of activity relevant to an insider threat investigation. This behavior may affect timestamps associated with file system artifacts, application activity, shell commands, authentication events, endpoint telemetry, browser history, document access, and other evidence used to reconstruct subject activity.

On macOS systems, this behavior may involve manual changes through System Settings or command-line modification using administrative utilities such as systemsetup or date. The subject may also disable automatic time synchronization, alter the configured network time server, or change the system time zone to introduce ambiguity into local timestamps.