Skip to main content
OT Atlas
Search

Hunt playbook

Time Synchronisation Manipulation

Detect changes to time sources or unexplained clock offsets across OT systems.

AdvancedT0885T0837

Hypothesis

Time sources or device clocks may have been altered.

Why this hunt matters

Reliable time underpins event correlation, protection schemes and forensic reconstruction.

Scope

Assets: time-server, ied, scada-server, historian

Protocols: dnp3, iec-60870-5-104

Data sources required

  • Time server logs
  • Device clock offset reporting
  • Configuration baselines
  • Protocol time-sync commands in network data

Baseline needed first

  • A single internal time hierarchy; offsets within defined tolerances

Hunt steps

  1. 01Collect configured time sources per device and diff against the standard
  2. 02Review offset and step-change events across OT systems
  3. 03Search network data for time-sync commands from unexpected sources
  4. 04Check whether log timestamps across systems still correlate

Indicators of interest

  • Devices pointing at external time sources
  • Sudden clock steps
  • Time-sync commands from non-master hosts
  • Log correlation breaking down

Triage

  • Did a protection or sequencing function depend on the affected clock?
  • Was the change part of maintenance?
  • Which systems drifted?

Likely false positives

  • GPS antenna faults
  • Planned time source migration
  • Leap second handling

Escalation

  • Time changes on protection or safety-related devices
  • Changes coinciding with other suspicious activity

Containment options

  • Restore correct time carefully — abrupt steps can affect sequencing and protection functions

Validation

  • Time hierarchy documented
  • Offset alerting implemented

Why should I care?

Containment in OT is a joint decision. Isolating a device can be the safest action or the one that stops production — operations decides, security advises.