Perform deep forensic analysis of time changes for security investigations and compliance auditing.
- Extract detailed XML data from Event ID 12010:
$events = Get-WinEvent -FilterHashtable @{LogName='System'; Id=12010} -MaxEvents 100
foreach ($event in $events) {
$xml = [xml]$event.ToXml()
$props = @{
TimeCreated = $event.TimeCreated
OldTime = $xml.Event.EventData.Data[0].'#text'
NewTime = $xml.Event.EventData.Data[1].'#text'
ProcessId = $xml.Event.EventData.Data[2].'#text'
ProcessName = $xml.Event.EventData.Data[3].'#text'
}
New-Object PSObject -Property $props
} | Export-Csv -Path "C:\temp\TimeChanges.csv" -NoTypeInformation
- Correlate with process execution events:
# Find processes that changed time
$timeChangeEvents = Get-WinEvent -FilterHashtable @{LogName='System'; Id=12010}
$processIds = $timeChangeEvents | ForEach-Object { ([xml]$_.ToXml()).Event.EventData.Data[2].'#text' }
# Look for process creation events
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688} | Where-Object {
$processIds -contains ([xml]$_.ToXml()).Event.EventData.Data[4].'#text'
}
- Analyze network time synchronization traffic:
# Check NTP traffic (requires elevated privileges)
netsh trace start capture=yes provider=Microsoft-Windows-TCPIP tracefile=C:\temp\ntp_trace.etl
# Wait for time sync to occur
netsh trace stop
- Review security audit logs for time privilege usage:
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4673} | Where-Object {
$_.Message -like "*SeSystemtimePrivilege*"
} | Select-Object TimeCreated, Id, @{Name='User';Expression={([xml]$_.ToXml()).Event.EventData.Data[1].'#text'}}
- Generate comprehensive time change report:
# Comprehensive time analysis report
$report = @()
$timeEvents = Get-WinEvent -FilterHashtable @{LogName='System'; Id=12010} -MaxEvents 1000
foreach ($event in $timeEvents) {
$xml = [xml]$event.ToXml()
$oldTime = [datetime]$xml.Event.EventData.Data[0].'#text'
$newTime = [datetime]$xml.Event.EventData.Data[1].'#text'
$timeDiff = ($newTime - $oldTime).TotalSeconds
$report += [PSCustomObject]@{
EventTime = $event.TimeCreated
OldTime = $oldTime
NewTime = $newTime
TimeDifferenceSeconds = $timeDiff
ProcessName = $xml.Event.EventData.Data[3].'#text'
Suspicious = [Math]::Abs($timeDiff) -gt 300 # Flag changes > 5 minutes
}
}
$report | Export-Csv -Path "C:\temp\TimeChangeAnalysis.csv" -NoTypeInformation
Warning: Time manipulation can be used to evade detection systems. Always correlate Event ID 12010 with other security events during incident response.
