detection.wiki

Microsoft-Windows-Time-Service › Event 265

Event ID 265 — The time service is now synchronizing the system time with the reference time source Name with reference id TimeSource.

Provider
Microsoft-Windows-Time-Service
Channel
Operational
Level
Informational

Description

The time service is now synchronizing the system time with the reference time source Name with reference id TimeSource. Current local stratum number is TimeSourceRefId, System Tick Count: LocalStratumNumber.

Message #

The time service is now synchronizing the system time with the reference time source %1 with reference id %2. Current local stratum number is %3, System Tick Count: %4.
For more information, see https://go.microsoft.com/fwlink/?linkid=845961.

Fields #

NameDescription
Name—
TimeSource UnicodeString—
TimeSourceRefId UnicodeString—
LocalStratumNumber UInt32—
TickCount UInt64—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Time-Service",
    "guid": "06EDCFEB-0FD0-4E53-ACCA-A6F8BBF81BCB",
    "event_source_name": "",
    "event_id": 265,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2023-11-05T22:26:18.430549+00:00",
    "event_record_id": 19,
    "correlation": {},
    "execution": {
      "process_id": 1644,
      "thread_id": 1720
    },
    "channel": "Microsoft-Windows-Time-Service/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "Name": "TMP_OPS_TIME_SOURCE_REFERENCE",
    "TimeSource": "time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->40.119.148.38:123)",
    "TimeSourceRefId": "0x28779426",
    "LocalStratumNumber": 4,
    "TickCount": 77656
  },
  "message": ""
}

References #