Does the Splunk universal forwarder offer some sort of time monitoring feature? (TOCTOU?)

[daniel333]

All,

SO bad guy changes the time on the system. Does the fowarder KNOW there is a sudden time change and log it? I think security pros call this TOCTOU?

https://en.wikipedia.org/wiki/Time_of_check_to_time_of_use