Timestomp

What the technique is

Adversaries may modify file time attributes to hide new files or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder and blend malicious files with legitimate files. In Windows systems, both the $STANDARD_INFORMATION ($SI) and $FILE_NAME ($FN) attributes record times in a Master File Table (MFT) file. $SI (dates/time stamps) is displayed to the end user, including in the File System view, while $FN is dealt with by the kernel. Modifying the $SI attribute is the most common method of timestomping because it can be modified at the user level using API calls. $FN timestomping, however, typically requires interacting with the system kernel or moving or renaming a file. Adversaries modify timestamps on files so that they do not appear conspicuous to forensic investigators or file analysis tools. In order to evade detections that rely on identifying discrepancies between the $SI and $FN attributes, adversaries may also engage in “double timestomping” by modifying times on both attributes simultaneously. […]

What MITRE says you would watch

• AN1626

  Detects attempts to modify file timestamps via API usage (e.g., SetFileTime), CLI tools (e.g., w32tm, PowerShell), or double-timestomp behavior where $SI and $FN timestamps are mismatched or reverted.

• AN1627

  Detects use of timestamp-altering commands like touch -a -m -t or touch -r, particularly when executed by unusual users or in suspicious directories.

• AN1628

  Detects timestamp changes using touch, SetFile, or direct metadata tampering (e.g., xattr manipulation) from Terminal, scripts, or low-level APIs.