Home/ATT&CK Technique/Timestomp
ATT&CK Technique

Timestomp

T1070.006 · stealth

Adversaries may modify file time attributes to hide new files or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder and blend malicious files with legitimate files. In Windows systems, both the $STANDARD_INFORMATION ($SI) and $FILE_NAME ($FN) attributes record times in a Master File Table (MFT) file. $SI (dates/time stamps) is displayed to the end user, including in the File System view, while $FN is dealt with by the kernel.

Modifying the $SI attribute is the most common method of timestomping because it can be modified at the user level using API calls. $FN timestomping, however, typically requires interacting with the system kernel or moving or renaming a file. Adversaries modify timestamps on files so that they do not appear conspicuous to forensic investigators or file analysis tools. In order to evade detections that rely on identifying discrepancies between the $SI and $FN attributes, adversaries may also engage in “double timestomping” by modifying times on both attributes simultaneously.

In Linux systems and on ESXi servers, threat actors may attempt to perform timestomping using commands such as touch -a -m -t <timestamp> <filename> (which sets access and modification times to a specific value) or touch -r <filename> <filename> (which sets access and modification times to match those of another file). Timestomping may be used along with file name Masquerading to hide malware and tools.

ESXiLinuxmacOSWindows

Actors Using This

14
north_koreaAndariel
chinaAPT10
russiaAPT28
russiaAPT29
chinaAPT31
iranOilRig
north_koreaAPT38
chinaAPT40
china_state_sponsored_mandiant_canonical_microsoft_mulberry_typhoonAPT5 (UNC2630 / UNC2717 / Mulberry Typhoon)
russia_apt_sandwormBlackEnergy
north_koreaCitrine Sleet
russia_speaking_organized_cybercrimeDarkSide / BlackMatter
russiaDragonfly

Likely Attack Path

Techniques the same actors pair with this one distinctively - those showing up among actors who use this technique noticeably more than across all actors (lift > 1.15), grouped by kill-chain phase. The × is that lift multiplier; the shared-actor count is in the tooltip. A near-universal technique pairs with everything at baseline, so its list is short by design.
reconnaissance same

Atomic Tests

10
Executable Atomic Red Team test cases for exercising this technique in a lab. Copy a command, run it on the listed platform, confirm your detections fire.
shlinux, macosSet a file's access timestamp
Stomps on the access timestamp of a file
touch -a -t 197001010000.00 #{target_filename}
shlinux, macosSet a file's modification timestamp
Stomps on the modification timestamp of a file
touch -m -t 197001010000.00 #{target_filename}
shelevatedlinux, macosSet a file's creation timestamp
Stomps on the create timestamp of a file Setting the creation timestamp requires changing the system clock and reverting. Sudo or root privileges are required to change date. Use with caution.
NOW=$(date +%m%d%H%M%Y)
date 010100001971
touch #{target_filename}
date "$NOW"
stat #{target_filename}
shlinux, macosModify file timestamps using reference file
Modifies the `modify` and `access` timestamps using the timestamps of a specified reference file. This technique was used by the threat actor Rocke during the compromise of Linux web servers.
touch #{target_file_path}
touch -acmr #{reference_file_path} #{target_file_path}
powershellwindowsWindows - Modify file creation timestamp with PowerShell
Modifies the file creation timestamp of a specified file. This technique was seen in use by the Stitch RAT. To verify execution, use File Explorer to view the Properties of the file and observe that the Created time is the year 1970.
Get-ChildItem "#{file_path}" | % { $_.CreationTime = "#{target_date_time}" }
powershellwindowsWindows - Modify file last modified timestamp with PowerShell
Modifies the file last modified timestamp of a specified file. This technique was seen in use by the Stitch RAT. To verify execution, use File Explorer to view the Properties of the file and observe that the Modified time is the year 1970.
Get-ChildItem "#{file_path}" | % { $_.LastWriteTime = "#{target_date_time}" }
powershellwindowsWindows - Modify file last access timestamp with PowerShell
Modifies the last access timestamp of a specified file. This technique was seen in use by the Stitch RAT. To verify execution, use File Explorer to view the Properties of the file and observe that the Accessed time is the year 1970.
Get-ChildItem "#{file_path}" | % { $_.LastAccessTime = "#{target_date_time}" }
powershellwindowsWindows - Timestomp a File
Timestomp kxwn.lock. Successful execution will include the placement of kxwn.lock in #{file_path} and execution of timestomp.ps1 to modify the time of the .lock file. [Mitre ATT&CK Evals](https://github.com/mitre-attack/attack-arsenal/blob/master/adversary_emulation/APT29/CALDERA_DIY/evals/data/abilities/defensive-evasion/4a2ad84e-a93a-4b2e-b1f0-c354d6a41278.yml)
import-module "#{file_path}\timestomp.ps1"
timestomp -dest "#{file_path}\kxwn.lock"
shmacosMacOS - Timestomp Date Modified
Stomps on the modification timestamp of a file using MacOS's SetFile utility
SetFile -m #{target_date} #{target_filename}
powershellelevatedwindowsEvent Log Manipulations- Time slipping via Powershell
Changes the system time on the computer to a time that you specify. It involves altering the system’s clock or adjusting the dates of files, affecting timestamp integrity within Event Logs. This technique can disrupt the sequence of logged events, complicating incident analysis and forensics. Reference - https://detect.fyi/event-log-manipulations-1-time-slipping-55bf95631c40 https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/set-date?view=powershell-7.4
try{ 
  Set-Date -Date (Get-Date).AddDays(#{days_to_modify})
  Add-Content "$env:APPDATA\slipDays.bak" #{days_to_modify}
}
catch {exit 1}

Detection Coverage

1/6 layers
Coverage across standard detection surfaces. Rows marked none have no rule of that type mapped. Some are real blind spots worth closing; others are simply not applicable to this technique (e.g. YARA matches malware files, not network behaviour).
Behavioral / log (Sigma) 5
Analytics (MITRE CAR) none
Runtime / container (Falco) none
File / malware (YARA) none
Network (Suricata/Snort) none
Vuln scan (Nuclei) none
Intelligence Graph · click any node to traverse
CVETechnique ActorTool Family
drag to reposition · click any node to traverse · button top-right enlarges
External lookups - second-class, for what we don’t hold ourselves
Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities
Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs
Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures
Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1
About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service
threatengine.sh  ·  Open-source threat intelligence platform  ·  100+ authoritative sources  ·  Every fact traces to its origin