T1070.006 — Timestomp

Tactic: Stealth · Platforms: ESXi, Linux, macOS, Windows

Adversaries may modify file time attributes to hide new files or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder and blend malicious files with legitimate…

Sub-technique of Indicator Removal (T1070).

Sigma detection rules (4)

T1070.006 Indicator Removal: Timestomp - File Attribute/Timestamp Access Events

title: "T1070.006 Indicator Removal: Timestomp - File Attribute/Timestamp Access Events"
id: e397e754-a1ce-442d-9604-945f65d41da7
description: 'Detects file-access events (Security 4663/4670/4656) against a file where the access list includes WriteAttributes (%%4423) — requires ''Audit Detailed File Share''/object access auditing enabled; a corroborating signal rather than a strong standalone indicator.'
references:
  - https://attack.mitre.org/techniques/T1070/006/
author: Shahrukh Khan
date: 2026-07-10
license: MIT
tags:
  - attack.stealth
  - attack.t1070.006

logsource:
  product: windows
  service: security

detection:
  selection:
    EventID:
      - 4663
      - 4670
      - 4656

  selection_write_attrs:
    AccessList|contains: '%%4423'

  condition: selection and selection_write_attrs

falsepositives:
  - Very high volume on any system with object access auditing enabled — must be scoped to specific monitored paths

level: low

T1070.006 Indicator Removal: Timestomp

title: "T1070.006 Indicator Removal: Timestomp"
id: 57ecc218-2657-4ae3-acbe-92e2c33e1022
description: 'Cross-Platform Behavioral Detection of File Timestomping via Metadata Tampering. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: MonitoredCommandList, FilePathRegex, DeltaThreshold.'
references:
  - https://attack.mitre.org/techniques/T1070/006
author: Shahrukh Khan
date: 2026-01-17
license: MIT
tags:
  - attack.stealth
  - attack.t1070.006

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: EXECVE
    a0|endswith: '/touch'
    a1|contains:
      - '-d'
      - '-r'
      - '-t'

  condition: selection

falsepositives:
  - touch -d/-r are used legitimately by build systems and deployment scripts to preserve or normalize timestamps; look for it applied to security-relevant binaries or config files specifically.

level: medium

T1070.006 Indicator Removal: Timestomp

title: "T1070.006 Indicator Removal: Timestomp"
id: d9194a09-616a-447a-8e4e-08c246f905e7
description: 'Cross-Platform Behavioral Detection of File Timestomping via Metadata Tampering. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: CommandMatch, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1070/006
author: Shahrukh Khan
date: 2026-03-28
license: MIT
tags:
  - attack.stealth
  - attack.t1070.006

logsource:
  category: process_creation
  product: macos

detection:
  sel_touch:
    Image|endswith: '/touch'
    CommandLine|re: '-t\s?\d{8,12}'
  sel_setfile:
    Image|endswith: '/SetFile'
    CommandLine|contains: '-d'

  condition: 1 of sel_*

falsepositives:
  - Build systems, installers, and archive extraction tools legitimately use touch -t or SetFile to normalize file timestamps.

level: medium

T1070.006 Indicator Removal: Timestomp

title: "T1070.006 Indicator Removal: Timestomp"
id: af5d1b71-60e5-482c-b644-cf765d1507b6
description: 'Cross-Platform Behavioral Detection of File Timestomping via Metadata Tampering. (Retargeted to the file_change ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: TimestampAgeComparison, PersistenceOverlap.'
references:
  - https://attack.mitre.org/techniques/T1070/006
author: Shahrukh Khan
date: 2026-03-14
license: MIT
tags:
  - attack.stealth
  - attack.t1070.006

logsource:
  category: file_change
  product: esxi
  service: shell

detection:
  selection:
    CommandLine|contains: 'touch -t'
  selection_target:
    CommandLine|contains:
      - '.vmx'
      - '/etc/rc.local.d/'
      - '/bin/'

  condition: selection and selection_target

falsepositives:
  - ESXi has no reliable structured field to compare file content modification time against metadata timestamp, so this only catches explicit touch -t invocations rather than stealthier timestomping methods.

level: medium

Related sub-techniques

Explore