Timestomping Detected via Touch

[rule]
description = """
This rule detects the use of the `touch` command to modify file timestamps. Attackers may use timestomping to manipulate
file timestamps to evade detection and alter the file's appearance. For example, attackers may change the file's
creation, modification, and access times to hide malicious activities or make the file appear legitimate.
"""
id = "8012a863-8c0c-4461-bb88-b0193dfb9f38"
license = "Elastic License v2"
name = "Timestomping Detected via Touch"
os_list = ["linux"]
version = "1.0.22"

query = '''
process where event.type == "start" and event.action == "exec" and process.name == "touch" and
process.parent.executable != null and process.args like (
  "-t*", "-d*", "-a*", "-m*", "-r*", "--date=*", "--reference=*", "--time=*"
) and process.args like (
  "/etc/*", "/bin/*", "/usr/bin/*", "/sbin/*", "/usr/sbin/*", "/opt/*", "/dev/shm/*",
  "/var/tmp/*", "/boot/*", "/root/*", "/usr/lib*", "/lib*"
) and not (
  process.parent.executable in (
    "/usr/local/bin/manage_omnimesh_logs", "/pro/bin/sys/install/packageUtils.sh", "/bin/dracut",
    "/usr/libexec/postfix/aliasesdb", "pwsh-preview", "/usr/bin/dracut", "/usr/share/initramfs-tools/hooks/amd64_microcode",
    "/usr/local/bin/start-mailserver.sh", "/usr/bin/ssm-agent-worker", "/bin/ssm-agent-worker", "/usr/local/cpanel/scripts/restartsrv_bind",
    "/usr/bin/vmtoolsd", "/usr/local/cpanel/bin/restartsrv_base", "/usr/lib/pcp/bin/pmie_check"
  ) or
  process.parent.executable like (
    "/opt/sw/tomcat/rc_scripts/*", "/tmp/newroot/var/lib/docker/overlay2/*", "/snap/*", "/opt/zeek/*", "/home/*/bin/ndex-rm.sh",
    "/root/.cache/act/*/staging_dir/host/bin/bash"
  ) or
  process.parent.name in (
    "xargs", "find", "sudo", "make", "pmlogger_check", "pmlogger_daily", "pmlogger_janitor", "autoupdate", "pmlogctl",
    "spyglass", "desktop-launch", "pmiectl"
  ) or
  process.parent.args like (
    "/home/*/scripts/auto_download_process.py", "/home/*/scripts/perl_python_eagu1p.py", "/var/lib/dpkg/info/*",
    "bazel-out/k8-dbg/bin/dependencies/thirdparty/libjansson_foreign_cc/build_script.sh", "/usr/lib/portage/python*/ebuild.sh",
    "/var/tmp/rpm-tmp.*", "/usr/lib/pcp/bin/pmlogger_janitor", "/usr/libexec/pcp/bin/pmlogger_janitor",
    "/usr/libexec/pcp/bin/pmlogger_daily", "/usr/lib/pcp/bin/pmlogger_daily", "/opt/oracle.ExaWatcher/GetExaWatcherResults.sh",
    "bazel-out/k8-dbg/bin/external/libzip+/libzip_foreign_cc/build_script.sh", "/builds/*/IP/embedded/platforms/stratawave-yocto/build/*/temp/run.sstate_unpack_package*",
    "/usr/local/bin/manage_omnimesh_logs"
  ) or
  process.args in (
    "/usr/bin/coreutils", "--no-create", "/etc/opt/lumu/lumud.conf", "/opt/vuso*", "/opt/diff", "/etc/aliases.db", "/opt/cursor/cursor"
  ) or
  process.args like (
    "--checkpoint=*", "/root/.config/envman/*", "/var/tmp/dracut*", "/var/tmp/portage*", "/snap/*", "/var/tmp/pmlogger_*/stamp",
    "/opt/ubki/*.jar", "/root/.cache/bazel/_bazel_root/*", "/root/.cache/act/*/hostexecutor/matrix/*/tmp/*.o",
    "/opt/ubki/*/cassandra-repair-dev-test/*"
  ) or
  process.command_line in (
    "/bin/touch -a /tmp/au_status", "touch -d 2 seconds ago /etc/postfix/main.cf", "touch -a /etc/apt/client.key /etc/apt/client.crt",
    "touch -r /etc/aliases.lmdb /var/lib/misc/postfix.aliasesdb-stamp"
  ) or
  process.parent.command_line == "runc init" or
  process.working_directory in ("/opt/libexec", "/opt/local/src/connectxx/build/src/mdp") or
  (process.args like "/var/tmp/pmlogger_check.*/_stamp" and process.parent.args == "/usr/libexec/pcp/bin/pmlogger_check") or
  (process.parent.executable == "/usr/bin/ninja" and process.parent.command_line like "ninja*")
)
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1070"
name = "Indicator Removal"
reference = "https://attack.mitre.org/techniques/T1070/"
[[threat.technique.subtechnique]]
id = "T1070.006"
name = "Timestomp"
reference = "https://attack.mitre.org/techniques/T1070/006/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.15.0"