{"id":"T1070.006","name":"Timestomp","url":"https://attack.mitre.org/techniques/T1070/006","tactics":["stealth"],"platforms":["ESXi","Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0591","stix_id":"x-mitre-detection-strategy--f9d25557-f87b-4920-a98b-8a3c9df4bfce","name":"Cross-Platform Behavioral Detection of File Timestomping via Metadata Tampering","url":"https://attack.mitre.org/detectionstrategies/DET0591","analytics":[{"id":"AN1626","stix_id":"x-mitre-analytic--475a8817-1ace-4bef-baaa-0f56979eb85a","name":"Analytic 1626","description":"Detects attempts to modify file timestamps via API usage (e.g., `SetFileTime`), CLI tools (e.g., `w32tm`, PowerShell), or double-timestomp behavior where $SI and $FN timestamps are mismatched or reverted.","url":"https://attack.mitre.org/detectionstrategies/DET0591#AN1626","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=15","data_component":"DC0059","data_component_name":"File Metadata","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Security","channel":"EventCode=4663, 4670, 4656","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"wineventlog-security"},{"name":"EDR:file","channel":"SetFileTime","data_component":"DC0021","data_component_name":"OS API Execution","log_source_slug":"edr-file"}],"mutable_elements":[{"field":"TimeWindow","description":"Correlate timestamp change with preceding file creation or suspicious access"},{"field":"APINamePattern","description":"Include SetFileTime, NtSetInformationFile, or other timestamp APIs"},{"field":"TimestampDeltaThreshold","description":"Trigger on excessive backdating (e.g., >90 days)"}],"live":true,"detection_strategies":["DET0591"],"techniques":["T1070.006"]},{"id":"AN1627","stix_id":"x-mitre-analytic--632f7aef-f848-4147-95fa-2052bd373576","name":"Analytic 1627","description":"Detects use of timestamp-altering commands like `touch -a -m -t` or `touch -r`, particularly when executed by unusual users or in suspicious directories.","url":"https://attack.mitre.org/detectionstrategies/DET0591#AN1627","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"execve","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"},{"name":"linux:osquery","channel":"file_events","data_component":"DC0059","data_component_name":"File Metadata","log_source_slug":"linux-osquery"}],"mutable_elements":[{"field":"MonitoredCommandList","description":"Commands like `touch -r`, `debugfs`, `stat` used in sequence"},{"field":"FilePathRegex","description":"Suspicious paths like `/tmp/`, `/var/lib/`, `/mnt/esxi/`"},{"field":"DeltaThreshold","description":"Mismatch between timestamp and file activity time"}],"live":true,"detection_strategies":["DET0591"],"techniques":["T1070.006"]},{"id":"AN1628","stix_id":"x-mitre-analytic--097ce8cb-9a38-4c8a-836c-cee15ccdf258","name":"Analytic 1628","description":"Detects timestamp changes using `touch`, `SetFile`, or direct metadata tampering (e.g., xattr manipulation) from Terminal, scripts, or low-level APIs.","url":"https://attack.mitre.org/detectionstrategies/DET0591#AN1628","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"log stream --predicate","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"macos-unifiedlog"},{"name":"macos:osquery","channel":"file_events","data_component":"DC0059","data_component_name":"File Metadata","log_source_slug":"macos-osquery"}],"mutable_elements":[{"field":"CommandMatch","description":"Touch/setfile and backdated timestamps"},{"field":"UserContext","description":"Detects execution under non-interactive/system accounts"}],"live":true,"detection_strategies":["DET0591"],"techniques":["T1070.006"]},{"id":"AN1629","stix_id":"x-mitre-analytic--1c3cb010-1c22-40c8-92d3-52e31353ad92","name":"Analytic 1629","description":"Detects abuse of busybox commands (e.g., `touch`) or log timestamp tampering during backdoor persistence or evasion.","url":"https://attack.mitre.org/detectionstrategies/DET0591#AN1629","platforms":["ESXi"],"log_source_references":[{"name":"esxi:vmkernel","channel":"/var/log/vmkernel.log","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"esxi-vmkernel"}],"mutable_elements":[{"field":"TimestampAgeComparison","description":"Unusual backdating to match legit files"},{"field":"PersistenceOverlap","description":"Overlap with known persistence paths"}],"live":true,"detection_strategies":["DET0591"],"techniques":["T1070.006"]}],"live":true,"version":"1.0","techniques":["T1070.006"]}],"sigma_rules":[{"id":"31545105-3444-4584-bebf-c466353230d2","title":"Touch Suspicious Service File","author":"Joseliyo Sanchez, @Joseliyo_Jstnk","status":"test","level":"medium","date":"2023-01-11","modified":null,"description":"Detects usage of the \"touch\" process in service file.","references":["https://blogs.blackberry.com/","https://twitter.com/Joseliyo_Jstnk/status/1620131033474822144"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.stealth","attack.t1070.006"],"path":"rules/linux/process_creation/proc_creation_lnx_touch_susp.yml","techniques":["T1070.006"],"cves":[]},{"id":"558eebe5-f2ba-4104-b339-36f7902bcc1a","title":"File Creation Date Changed to Another Year","author":"frack113, Florian Roth (Nextron Systems)","status":"test","level":"low","date":"2022-08-12","modified":"2026-01-20","description":"Detects when the file creation time is changed to a year before 2020.\nAttackers may change the file creation time of a backdoor to make it look like it was installed with the operating system.\nNote that many processes legitimately change the creation time of a file; it does not necessarily indicate malicious activity.\nIn order to use this rule in production, it is recommended first baseline normal behavior in your environment and then tune the rule accordingly.\nHunting Recommendation: Focus on files with creation times set to years significantly before the current date, especially those in user-writable directories.\nCorrelate with process execution logs to identify the source of the modification and investigate any unsigned or suspicious binaries involved.\n","references":["https://www.inversecos.com/2022/04/defence-evasion-technique-timestomping.html"],"logsource":{"product":"windows","category":"file_change"},"tags":["attack.stealth","attack.t1070.006","detection.threat-hunting"],"path":"rules-threat-hunting/windows/file/file_change/file_change_win_date_changed_to_another_year.yml","techniques":["T1070.006"],"cves":[]},{"id":"88c0f9d8-30a8-4120-bb6b-ebb54abcf2a0","title":"File Time Attribute Change","author":"Igor Fits, Mikhail Larin, oscd.community","status":"test","level":"medium","date":"2020-10-19","modified":"2022-01-12","description":"Detect file time attribute change to hide new or changes to existing files","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.006/T1070.006.md"],"logsource":{"product":"macos","category":"process_creation"},"tags":["attack.stealth","attack.t1070.006"],"path":"rules/macos/process_creation/proc_creation_macos_change_file_time_attr.yml","techniques":["T1070.006"],"cves":[]},{"id":"b3cec4e7-6901-4b0d-a02d-8ab2d8eb818b","title":"File Time Attribute Change - Linux","author":"Igor Fits, oscd.community","status":"test","level":"medium","date":"2020-10-15","modified":"2022-11-28","description":"Detect file time attribute change to hide new or changes to existing files.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.006/T1070.006.md"],"logsource":{"product":"linux","service":"auditd"},"tags":["attack.stealth","attack.t1070.006"],"path":"rules/linux/auditd/execve/lnx_auditd_change_file_time_attr.yml","techniques":["T1070.006"],"cves":[]},{"id":"c6438007-e081-42ce-9483-b067fbef33c3","title":"Powershell Timestomp","author":"frack113","status":"test","level":"medium","date":"2021-08-03","modified":"2022-12-25","description":"Adversaries may modify file time attributes to hide new or changes to existing files.\nTimestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder.\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.006/T1070.006.md","https://www.offensive-security.com/metasploit-unleashed/timestomp/"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.stealth","attack.t1070.006"],"path":"rules/windows/powershell/powershell_script/posh_ps_timestomp.yml","techniques":["T1070.006"],"cves":[]},{"id":"faa031b5-21ed-4e02-8881-2591f98d82ed","title":"Unauthorized System Time Modification","author":"@neu5ron","status":"test","level":"low","date":"2019-02-05","modified":"2025-12-03","description":"Detect scenarios where a potentially unauthorized application or user is modifying the system time.","references":["Private Cuckoo Sandbox (from many years ago, no longer have hash, NDA as well)","Live environment caused by malware","https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4616"],"logsource":{"product":"windows","service":"security"},"tags":["attack.stealth","attack.t1070.006"],"path":"rules/windows/builtin/security/win_security_susp_time_modification.yml","techniques":["T1070.006"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}