Timestomp (MITRE ATT&CK T1070.006) is a Stealth technique. MITRE lists ESXi, Linux, macOS and Windows as platforms.
A file carries modify, access, create and change times. Timestomping modifies those attributes to hide new files or changes to existing files. The usual goal is to mimic other files in the same folder so that a malicious file blends in with legitimate ones.
How attackers use it
Windows. MITRE explains that both the $STANDARD_INFORMATION ($SI) and $FILE_NAME ($FN) attributes record times in the Master File Table (MFT). $SI is what users see, including in the file system view. $FN is managed by the kernel. Changing $SI is the most common method, since it can be done at user level through API calls. Changing $FN generally requires touching the kernel, or moving or renaming a file.
Adversaries adjust times so files do not look out of place to forensic investigators or file analysis tools. To beat checks that look for differences between $SI and $FN, they may do double timestomping and change both at once.
Linux and ESXi. MITRE names two forms of the touch command. One sets access and modification times to a specific value with touch -a -m -t followed by a timestamp and the file name. The other copies the times from another file with touch -r.
MITRE adds that timestomping may be used along with file name masquerading to hide malware and tools.
How to detect it
MITRE's detection strategy has four analytics:
- Windows: attempts to change file times through API use such as
SetFileTime, CLI tools such as w32tm or PowerShell, or double timestomp behavior where$SIand$FNtimestamps do not match or are reverted. - Linux: use of
touch -a -m -tortouch -r, particularly by unusual users or in suspicious directories. - macOS: timestamp changes through touch, SetFile or direct metadata tampering such as xattr manipulation, from Terminal, scripts or low-level APIs.
- ESXi and embedded systems: abuse of busybox commands such as touch, or log timestamp tampering during backdoor persistence or evasion.
Data to collect:
- On Windows, Sysmon Event ID 2 records when a process changes a file creation time. It is one of the more direct signals available.
- Process creation with command line for touch, SetFile and PowerShell.
- On Linux, auditd rules on the utimensat family of system calls for directories that should not change, if your volume allows it.
- File system forensic data, where you can compare
$SIand$FNin the MFT.
How to reduce the risk
MITRE says this technique cannot be easily mitigated with preventive controls since it abuses system features. Practical steps follow from detection:
- Collect file creation and metadata events with the process responsible, because a changed timestamp does not change what the process did.
- Keep other timelines that an attacker cannot easily edit, such as central logs, EDR telemetry, and backups.
- Use the Change time on Linux and macOS as a cross-check, as shown below.
Check your own environment
# Linux: show all four times for a file (read only)
stat /path/to/file
# Linux or macOS: list files by change time rather than modify time
ls -lc /path/to/dir
On Linux, the change time (ctime) is set by the kernel when a file's metadata is modified, and touch cannot set it directly. A file whose modify time is years older than its change time, in a folder where everything else changed recently, deserves a look.
# Windows PowerShell: recent Sysmon file creation time change events (read only; needs Sysmon)
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational'; Id=2} -MaxEvents 20 -ErrorAction SilentlyContinue
Quick check
Why is changing the $FN attribute harder than changing $SI?
$FN is managed by the kernel. Changing it typically requires interacting with the kernel, or moving or renaming a file, while $SI can be changed from user level through API calls.
What is double timestomping?
Changing the times on both $SI and $FN at once, to defeat checks that look for discrepancies between them.
