DFIRHub

Windows event log ยท System1 The system time was changed / Sleep/wake events

  • System
  • 6 fields
  • System.evtx
  • Microsoft-Windows-Kernel-GeneralMicrosoft-Windows-Power-Troubleshooter

The system time was changed

Provider Microsoft-Windows-Kernel-General

  • PayloadData1OldTime: %OldTime%
    • %OldTime% = /Event/EventData/Data[@Name="OldTime"]
  • PayloadData2NewTime: %NewTime%
    • %NewTime% = /Event/EventData/Data[@Name="NewTime"]
  • PayloadData3Reason: %Reason%
    • %Reason% = /Event/EventData/Data[@Name="Reason"]

Sleep/wake events

Provider Microsoft-Windows-Power-Troubleshooter

  • PayloadData1Sleep duration: %SleepDuration%
    • %SleepDuration% = /Event/EventData/Data[@Name="SleepDuration"]
  • PayloadData2Wake source: %WakeSourceType%
    • %WakeSourceType% = /Event/EventData/Data[@Name="WakeSourceType"]
  • PayloadData3Wake source text %WakeSourceText%
    • %WakeSourceText% = /Event/EventData/Data[@Name="WakeSourceText"]

Value lookups

Codes that EvtxECmd turns into text

Reason

1
An application or system component changed the time.
2
System time synchronized with the hardware clock.
3
System time adjusted to the new time zone.

WakeSourceType

0
Unknown
1
Power button
3
Waking from sleep to hibernate
5
Device (See WakeSourceText for details)
6
Timer (See WakeSourceText for details)

Sample event

Microsoft-Windows-Kernel-General event XML

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{GUID}"/>
    <EventID>1</EventID>
    <Version>2</Version>
    <Level>4</Level>
    <Task>5</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000010</Keywords>
    <TimeCreated SystemTime="2020-11-08T17:55:55.8080736Z"/>
    <EventRecordID>5855</EventRecordID>
    <Correlation/>
    <Execution ProcessID="12840" ThreadID="13020"/>
    <Channel>System</Channel>
    <Computer>ComputerName</Computer>
    <Security UserID="{UserID}"/>
  </System>
  <EventData>
    <Data Name="NewTime">2020-11-08T17:55:55.8076950Z</Data>
    <Data Name="OldTime">2020-11-08T17:55:53.0958112Z</Data>
    <Data Name="Reason">1</Data>
    <Data Name="ProcessName">\Device\HarddiskVolume3\Windows\System32\svchost.exe</Data>
    <Data Name="ProcessID">12840</Data>
  </EventData>
</Event>

Sample event

Microsoft-Windows-Power-Troubleshooter event XML

<Event>
  <System>
    <Provider Name="Microsoft-Windows-Power-Troubleshooter" Guid="cdc05e28-c449-49c6-b9d2-88cf761644df"/>
    <EventID>1</EventID>
    <Version>3</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2020-09-18 03:28:36.5759038"/>
    <EventRecordID>2671</EventRecordID>
    <Correlation ActivityID="c87105b8-7de4-4a4c-b194-2a9c9e702069"/>
    <Execution ProcessID="5228" ThreadID="11928"/>
    <Channel>System</Channel>
    <Computer>win-gist</Computer>
    <Security UserID="S-1-5-19"/>
  </System>
  <EventData>
    <Data Name="SleepTime">2020-09-18 03:18:35.0664609</Data>
    <Data Name="WakeTime">2020-09-18 03:28:35.8899669</Data>
    <Data Name="SleepDuration">1029</Data>
    <Data Name="WakeDuration">6389</Data>
    <Data Name="DriverInitDuration">5716</Data>
    <Data Name="BiosInitDuration">1042</Data>
    <Data Name="HiberWriteDuration">0</Data>
    <Data Name="HiberReadDuration">0</Data>
    <Data Name="HiberPagesWritten">0</Data>
    <Data Name="Attributes">1912628224</Data>
    <Data Name="TargetState">4</Data>
    <Data Name="EffectiveState">4</Data>
    <Data Name="WakeSourceType">6</Data>
    <Data Name="WakeSourceTextLength">128</Data>
    <Data Name="WakeSourceText">Windows will execute 'NT TASK\Microsoft\Windows\UpdateOrchestrator\Reboot_AC' scheduled task that requested waking the computer.</Data>
    <Data Name="WakeTimerOwnerLength">52</Data>
    <Data Name="WakeTimerContextLength">18</Data>
    <Data Name="NoMultiStageResumeReason">0</Data>
    <Data Name="WakeTimerOwner">\Device\HarddiskVolume3\Windows\System32\svchost.exe</Data>
    <Data Name="WakeTimerContext">SystemEventsBroker</Data>
    <Data Name="CheckpointDuration">98</Data>
  </EventData>
</Event>

References

3 links

Source: evtx/Maps/System_Microsoft-Windows-Kernel-General_1.map(opens in new tab), evtx/Maps/System_Microsoft-Windows-Power-Troubleshooter_1.map(opens in new tab) by Hyun Yi @hyuunnn, Eric Zimmerman and contributors(opens in new tab), MIT License(opens in new tab)