EnumTimeFormatsEx callback abuse for code execution

Emiliano Mema@Nosalva

•updated Jul 9, 2026•1•0•3

This rule detects the use of the 'EnumTimeFormatsEx' Windows API function by monitoring device events. This API is used to enumerate time formats supported by a locale. While potentially benign, it is frequently used in reconnaissance or anti-sandbox techniques by malware to determine environment settings or to fingerprint the target system.