detection.wiki

Microsoft-Windows-Time-Service › Event 35

Event ID 35 — The time service is now synchronizing the system time with the time source Name with reference id TimeSource.

Provider
Microsoft-Windows-Time-Service
Channel
System
Level
Informational

Description

The time service is now synchronizing the system time with the time source Name with reference id TimeSource. Current local stratum number is TimeSourceRefId.

Message #

The time service is now synchronizing the system time with the time source %1 with reference id %2. Current local stratum number is %3.

Fields #

NameDescription
Name—
TimeSource UnicodeString—
TimeSourceRefId UInt32—
CurrentStratumNumber UInt32—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Time-Service",
    "guid": "06EDCFEB-0FD0-4E53-ACCA-A6F8BBF81BCB",
    "event_source_name": "",
    "event_id": 35,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2023-11-05T22:26:18.430557+00:00",
    "event_record_id": 1711,
    "correlation": {},
    "execution": {
      "process_id": 1644,
      "thread_id": 1720
    },
    "channel": "System",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "Name": "TMP_EVENT_TIME_SOURCE_CHOSEN",
    "TimeSource": "time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->40.119.148.38:123)",
    "TimeSourceRefId": 647264040,
    "CurrentStratumNumber": 4
  },
  "message": ""
}

References #