4616 Security log · System high severity low volume

Windows Event ID 4616 — The system time was changed

System time was modified. PreviousTime and NewTime are key. SubjectUserName shows who changed it.

Why event 4616 matters

Attackers modify system time to create confusion in forensic timelines, expire Kerberos tickets (triggering re-authentication for harvest), or bypass time-based access controls. Kerberos has a 5-minute clock skew tolerance — modifying time by >5 minutes can disrupt Kerberos auth.

How to detect it

Alert: time change >5 minutes by non-SYSTEM accounts or non-W32tm process. Alert: time moved backward (anti-forensics). Alert: multiple time changes in rapid succession.

Log source
Security
Advanced Audit Policy — enable the 'System' subcategory (Success and/or Failure).
Fields to pivot on
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName

MITRE ATT&CK mapping

Tactic Technique
Defense Evasion Indicator Removal: Timestomp (T1070.006)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sigma rule
title: Suspicious System Time Change
status: stable
description: System time modified by non-time-service account
author: theadminstack.com
date: 2026/05/16
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4616
    filter_w32tm:
        SubjectUserName: 'LOCAL SERVICE'
        ProcessName|endswith: '\\w32tm.exe'
    condition: selection and not filter_w32tm
falsepositives:
    - Legitimate time sync
    - Hypervisor time adjustment
level: medium
tags:
    - attack.defense_evasion
    - attack.t1070.006
Sentinel / Defender KQL
SecurityEvent
| where EventID == 4616   // The system time was changed
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated desc
Splunk SPL
index=* sourcetype="WinEventLog:Security" EventCode=4616
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# The system time was changed — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`
Hunt event 4616 in Sentinel/Defender →
Build a KQL query for this event in the KQL Query Builder.
Search all event IDs →
Open the interactive Windows Event ID lookup.

Related System events

4608 Windows is starting up 4621 Administrator recovered system from CrashOnAuditFail

Frequently asked questions

What is Windows Event ID 4616?

The system time was changed. System time was modified. PreviousTime and NewTime are key. SubjectUserName shows who changed it.

Which log records event 4616?

Event 4616 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'System' subcategory (Success and/or Failure).

What MITRE ATT&CK techniques map to event 4616?

Event 4616 is associated with: Indicator Removal: Timestomp (T1070.006).

How do you detect activity around event 4616?

Alert: time change >5 minutes by non-SYSTEM accounts or non-W32tm process. Alert: time moved backward (anti-forensics). Alert: multiple time changes in rapid succession.