Detects attempts to modify file timestamps via API usage (e.g., SetFileTime), CLI tools (e.g., w32tm, PowerShell), or double-timestomp behavior where $SI and $FN timestamps are mismatched or reverted.
| Data Component | Name | Channel |
|---|---|---|
| File Metadata (DC0059) | WinEventLog:Sysmon | EventCode=15 |
| File Access (DC0055) | WinEventLog:Security | EventCode=4663 |
| OS API Execution (DC0021) | EDR:file | SetFileTime |
| Field | Description |
|---|---|
| TimeWindow | Correlate timestamp change with preceding file creation or suspicious access |
| APINamePattern | Include SetFileTime, NtSetInformationFile, or other timestamp APIs |
| TimestampDeltaThreshold | Trigger on excessive backdating (e.g., >90 days) |
Detects use of timestamp-altering commands like touch -a -m -t or touch -r, particularly when executed by unusual users or in suspicious directories.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | auditd:SYSCALL | execve |
| File Metadata (DC0059) | linux:osquery | file_events |
| Field | Description |
|---|---|
| MonitoredCommandList | Commands like `touch -r`, `debugfs`, `stat` used in sequence |
| FilePathRegex | Suspicious paths like `/tmp/`, `/var/lib/`, `/mnt/esxi/` |
| DeltaThreshold | Mismatch between timestamp and file activity time |
Detects timestamp changes using touch, SetFile, or direct metadata tampering (e.g., xattr manipulation) from Terminal, scripts, or low-level APIs.
| Data Component | Name | Channel |
|---|---|---|
| Command Execution (DC0064) | macos:unifiedlog | log stream --predicate |
| File Metadata (DC0059) | macos:osquery | file_events |
| Field | Description |
|---|---|
| CommandMatch | Touch/setfile and backdated timestamps |
| UserContext | Detects execution under non-interactive/system accounts |
Detects abuse of busybox commands (e.g., touch) or log timestamp tampering during backdoor persistence or evasion.
| Data Component | Name | Channel |
|---|---|---|
| File Modification (DC0061) | esxi:vmkernel | /var/log/vmkernel.log |
| Field | Description |
|---|---|
| TimestampAgeComparison | Unusual backdating to match legit files |
| PersistenceOverlap | Overlap with known persistence paths |