Cross-source coverage
T1070.006 / ATT&CK
Indicator Removal: Timestomp
19 rules across 7 sources.
From MITRE ATT&CK 19.2
Adversaries may modify file time attributes to hide new files or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder and blend malicious files with legitimate files.
In Windows systems, both the $STANDARD_INFORMATION ($SI) and $FILE_NAME ($FN) attributes record times in a Master File Table (MFT) file. $SI (dates/time stamps) is displayed to the end user, including in the File System view, while $FN is dealt with by the kernel.
Modifying the $SI attribute is the most common method of timestomping because it can be modified at the user level using API calls. $FN timestomping, however, typically requires interacting with the system kernel or moving or renaming a file.
Adversaries modify timestamps on files so that they do not appear conspicuous to forensic investigators or file analysis tools. In order to evade detections that rely on identifying discrepancies between the $SI and $FN attributes, adversaries may also engage in “double timestomping” by modifying times on both attributes simultaneously.
In Linux systems and on ESXi servers, threat actors may attempt to perform timestomping using commands such as touch -a -m -t <timestamp> <filename> (which sets access and modification times to a specific value) or touch -r <filename> <filename> (which sets access and modification times to match those of another file).
Timestomping may be used along with file name Masquerading to hide malware and tools.
- Tactics
- Stealth
- Platforms
- ESXi · Linux · macOS · Windows
- Telemetry
-
WinEventLog:SysmonWinEventLog:SecurityEDR:fileauditd:SYSCALLlinux:osquerymacos:unifiedlogmacos:osqueryesxi:vmkernel
How MITRE says to detect it DET0591
Cross-Platform Behavioral Detection of File Timestomping via Metadata Tampering
Windows Analytic 1626
Detects attempts to modify file timestamps via API usage (e.g., `SetFileTime`), CLI tools (e.g., `w32tm`, PowerShell), or double-timestomp behavior where $SI and $FN timestamps are mismatched or reverted.
WinEventLog:SysmonEventCode=15WinEventLog:SecurityEventCode=4663, 4670, 4656EDR:fileSetFileTime
Linux Analytic 1627
Detects use of timestamp-altering commands like `touch -a -m -t` or `touch -r`, particularly when executed by unusual users or in suspicious directories.
auditd:SYSCALLexecvelinux:osqueryfile_events
macOS Analytic 1628
Detects timestamp changes using `touch`, `SetFile`, or direct metadata tampering (e.g., xattr manipulation) from Terminal, scripts, or low-level APIs.
macos:unifiedloglog stream --predicatemacos:osqueryfile_events
ESXi Analytic 1629
Detects abuse of busybox commands (e.g., `touch`) or log timestamp tampering during backdoor persistence or evasion.
esxi:vmkernel/var/log/vmkernel.log
SigmaHQ/sigma
6 rules| Detection | Severity | Format |
|---|---|---|
| File Time Attribute Change | Medium | Sigma |
| File Time Attribute Change - Linux | Medium | Sigma |
| Powershell Timestomp | Medium | Sigma |
| Touch Suspicious Service File | Medium | Sigma |
| File Creation Date Changed to Another Year | Low | Sigma |
| Unauthorized System Time Modification | Low | Sigma |
chainguard-dev/osquery-defense-kit
5 rules| Detection | Severity | Format |
|---|---|---|
| Alert on programs running that are unusually old | Undefined | osquery SQL |
| Files where the timestamp falls along 12-hour boundaries - probably caused by 'touch <date>0000' | Undefined | osquery SQL |
| Programs which appear to have been touched on macOS | Undefined | osquery SQL |
| Programs which claim to be from the future, based on (btime,ctime,mtime) | Undefined | osquery SQL |
| Programs which were spawned by an executable containing a matching ctime & mtime, which | Undefined | osquery SQL |
elastic/detection-rules
3 rules| Detection | Severity | Format |
|---|---|---|
| ESXI Timestomping using Touch Command | Medium | Elastic TOML |
| Potential Timestomp in Executable Files | Medium | Elastic TOML |
| Timestomping using Touch Command | Medium | Elastic TOML |
elastic/protections-artifacts
2 rules| Detection | Severity | Format |
|---|---|---|
| Potential Image Load with a Spoofed Creation Time | Undefined | Elastic TOML |
| Timestomping Detected via Touch | Undefined | Elastic TOML |
Wazuh Core Ruleset
1 rule| Detection | Severity | Format |
|---|---|---|
| Powershell executed a command that modifies file timestamp, possible timestomp attempt | Medium | Wazuh XML |
socfortress/Wazuh-Rules
1 rule| Detection | Severity | Format |
|---|---|---|
| Timestamp manipulation detected using 'touch' — possible timestomp activity (T1070.006) | Medium | Wazuh XML |
splunk/security_content
1 rule| Detection | Severity | Format |
|---|---|---|
| ESXi System Clock Manipulation | Undefined | SPL |