Remote System Time Queried via SMB

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•8

This rule detects attempts to query the remote system time via Server Message Block (SMB) by looking for the 'NetRemoteTOD' string in network traffic destined for port 445. This activity is often associated with discovery tactics, where an attacker tries to gather information about the target system.