SOC Event Lookup
Event ID 4616SystemP2

Windows Event ID 4616: The system time was changed

Applicable version
Windows Server 2008 R2 and later; Windows 7 and later
Last reviewed
2026-07-21

Quick summary

Windows Security Event ID 4616 records that the system clock was changed, capturing the previous and new time, the Subject account, and the process that performed the modification.

Technical Metadata

Technical metadata for Event ID 4616
Event ID4616
ProviderMicrosoft-Windows-Security-Auditing
ChannelSecurity
LevelInformation
Audit keywordAudit Success
MITRE ATT&CKNo reliable mapping listed
Key fields to watchSubject\Security ID, Process Information\Name, Previous Time / New Time

Trigger Scenarios

The Windows Time Service (w32tm) running as LOCAL SERVICE adjusts the clock against NTP sources and generates this event legitimately many times per day. Any other process or user account changing the system time also generates it and is the anomaly of interest.

Key Fields

Subject\Security ID

The SID of the account that changed the time. S-1-5-19 (LOCAL SERVICE, used by the Windows Time Service) is the expected value for normal NTP adjustments. Any SID other than S-1-5-19 is a Microsoft-documented alert condition.

Process Information\Name

The executable that made the API call. C:\Windows\System32\svchost.exe is the expected process for the Windows Time Service. Any other process path (e.g., a script host, a user application, or an attacker tool) performing the change is the concrete indicator of unauthorized modification.

Previous Time / New Time

The before-and-after system clock values. A large or unexpected jump can reorder event timelines and break time-based correlation, but it does not by itself indicate file timestomping.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Windows Event ID 4616
SecurityEvent
| where EventID == 4616
| project TimeGenerated, Computer, Account, EventData
| order by TimeGenerated desc
Data source
Microsoft Sentinel SecurityEvent table
Assumptions
The Windows Security Events connector populates SecurityEvent. Apply the event-specific field and correlation guidance on this page after retrieving the base events.
Query reference
Splunk SPL: Retrieve Windows Event ID 4616
index=wineventlog source="WinEventLog:Security" EventCode=4616
| table _time, host, user, EventCode, Message
Data source
Splunk Windows Security event data
Assumptions
Index, source, and field aliases vary by Splunk deployment and Windows add-on version. Map provider fields from the raw event before adding event-specific filtering or aggregation.
Cortex XQL: Retrieve Windows Event ID 4616
dataset = microsoft_windows_raw
| filter edr_event_id = 4616
Data source
Cortex XDR microsoft_windows_raw
Assumptions
The Windows Security channel is ingested into Cortex XDR. Inspect raw provider fields because parsed names vary by collection path.
Query reference
Sigma rule: Windows Security Event ID 4616
title: Windows Security Event ID 4616
status: experimental
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4616
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Security log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the field conditions and correlations documented on this page in the destination SIEM.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
Subject/Security IDLOCAL SERVICEWindows Time service normally changes the system clock under the LOCAL SERVICE identity.A different subject means the change did not come from the normal Windows Time service context and requires process correlation. Source
ProcessNameC:\Windows\System32\svchost.exeThe Windows Time service normally runs inside svchost.exe from the System32 directory.A different process or path is anomalous for normal time correction, although approved time-management software must be considered. Source

MITRE ATT&CK Mapping

No reliable mapping listed.

Detection Notes

Event ID 4616 has no direct ATT&CK technique mapping because T1070.006 applies to file timestamps, not the system clock. Alert when Subject/Security ID is not LOCAL SERVICE or ProcessName is not C:\Windows\System32\svchost.exe, then correlate SubjectLogonId and ProcessId with 4688 or Sysmon Event ID 1 to identify the initiating command and assess timeline impact.

Common False Positives

  • The Windows Time Service (LOCAL SERVICE via svchost.exe) performs routine NTP clock corrections and generates the majority of legitimate 4616 events.
  • Hypervisor clock synchronization on virtual machines can produce this event from expected system contexts.
  • Some hardware-synchronized time solutions or endpoint management agents adjust time and may produce this event from a service account.

Related Events

Sample Log

Sanitized event sample
Subject:
  Security ID: CORP\jsmith
  Account Name: jsmith
  Account Domain: CORP
  Logon ID: 0x4A3F2
Process Information:
  Name: C:\Windows\Temp\timeset.exe
Previous Time: 2026-07-12 11:05:00
New Time: 2026-07-12 09:00:00

Frequently Asked Questions

What does Windows Event ID 4616 mean?

Event ID 4616 records that the Windows system time changed and includes the actor, process, previous time, and new time.

Which 4616 events are normally expected?

Microsoft states that normal Windows Time corrections typically use the LOCAL SERVICE identity and C:\Windows\System32\svchost.exe process path.

Does Event ID 4616 map directly to ATT&CK Timestomp?

No. ATT&CK T1070.006 covers modification of file timestamps, while Event ID 4616 records a system-clock change; investigate it as timeline-integrity telemetry without claiming file timestomping.

Sources