US 12,271,470 B2
System and method for detecting and reporting system clock attacks within an indicators of attack platform
Marc N. McGarry, Murphy, TX (US); Nizar A. Basan, Garland, TX (US); and Weiqing Cai, Dallas, TX (US)
Assigned to Dell Products, L.P., Round Rock, TX (US)
Filed by Dell Products, L.P., Round Rock, TX (US)
Filed on Mar. 3, 2022, as Appl. No. 17/653,303.
Prior Publication US 2023/0281301 A1, Sep. 7, 2023
Int. Cl. G06F 21/55 (2013.01)
CPC G06F 21/552 (2013.01) [G06F 2221/034 (2013.01)] 16 Claims
OG exemplary drawing
 
1. An Information Handling System (IHS), comprising:
a processor; and
a memory coupled to the processor, the memory having instructions stored thereon that, upon execution by the processor, cause the IHS to:
obtain a system time from a system clock configured in the IHS;
obtain a network time from a network time protocol (NTP) server;
compare the system time against the network time; and
when the system time does not match the network time, set a system clock attack chain vector in a secure event log and generate an Indicator of Attack (IoA) report based at least in part, on the system clock attack chain vector;
when the system time matches the network time, reset the system clock attack chain vector in the secure event log; and
set a different attack chain vector in the secure event log and generate another IoA report based, at least in part, on the system clock attack chain vector and at least one attribute associated with at least one of a Basic Input/Output System (BIOS) or a Unified Extensible Firmware Interface (UEFI).