detection.wiki

Microsoft-Windows-Time-Service › Event 262

Event ID 262 — W32time service has adjusted the system clock rate by Name PPM and the new nominal clock rate is AdjustmentPPM.

Provider
Microsoft-Windows-Time-Service
Channel
Operational
Level
Informational

Description

W32time service has adjusted the system clock rate by Name PPM and the new nominal clock rate is AdjustmentPPM. Previous nominal clock rate was NewClockRate. System Tick Count: OldClockRate.

Message #

W32time service has adjusted the system clock rate by %1 PPM and the new nominal clock rate is %2. Previous nominal clock rate was %3. System Tick Count: %4.
Clock adjustments below %5 PPM are not logged. Performance counters are recommended to efficiently track small adjustment values.
For more information, see https://go.microsoft.com/fwlink/?linkid=845961.

Fields #

NameDescription
Name—
AdjustmentPPM UnicodeString—
NewClockRate UInt64—
OldClockRate UInt64—
TickCount UInt64—
MinReportedAdjustmentPPM UnicodeString—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Time-Service",
    "guid": "06EDCFEB-0FD0-4E53-ACCA-A6F8BBF81BCB",
    "event_source_name": "",
    "event_id": 262,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2022-04-04T14:09:39.947633+00:00",
    "event_record_id": 3168,
    "correlation": {},
    "execution": {
      "process_id": 1776,
      "thread_id": 1188
    },
    "channel": "Microsoft-Windows-Time-Service/Operational",
    "computer": "WIN-TKC15D7KHUR",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "Name": "TMP_OPS_SET_TIME_ADJUSTMENT",
    "AdjustmentPPM": "-832.90002",
    "NewClockRate": 156380,
    "OldClockRate": 156388,
    "TickCount": 3494593,
    "MinReportedAdjustmentPPM": "800.00000"
  },
  "message": ""
}

References #