Detect Timestomp in Google Chronicle

rule timestomp_t1070_006 {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects file timestomping via PowerShell SetFileTime API, Linux touch command, known timestomping tools, or Sysmon EventCode 2 file creation time changes (MITRE ATT&CK T1070.006)"
    mitre_attack = "T1070.006"
    severity = "HIGH"
    priority = "HIGH"
    reference = "https://attack.mitre.org/techniques/T1070/006/"

  events:
    (
      $e.metadata.event_type = "PROCESS_LAUNCH"
      and (
        (
          re.regex($e.principal.process.file.full_path, `(?i)(powershell\.exe|pwsh\.exe)$`)
          and re.regex($e.target.process.command_line, `(?i)(SetLastWriteTime|SetCreationTime|SetLastAccessTime|\[System\.IO\.File\].*Time)`)
        )
        or
        (
          re.regex($e.target.process.file.full_path, `(?i)touch$`)
          and re.regex($e.target.process.command_line, `(-t |-r |-a |-m |--time=)`)
        )
        or re.regex($e.target.process.file.full_path, `(?i)(timestomp\.exe|BTimeStomp\.exe)$`)
        or
        (
          re.regex($e.target.process.file.full_path, `(?i)cmd\.exe$`)
          and re.regex($e.target.process.command_line, `(?i)(timestomp|SetCreationTime|SetLastWriteTime)`)
        )
      )
    )
    or
    (
      $e.metadata.event_type = "FILE_MODIFICATION"
      and re.regex($e.target.file.full_path, `(?i)\.(exe|dll)$`)
      and re.regex($e.target.file.full_path, `(?i)(\\System32\\|\\SysWOW64\\|\\Windows\\)`)
      and not re.regex($e.principal.process.file.full_path, `(?i)(TrustedInstaller\.exe|wuauclt\.exe|MpSigStub\.exe|MpCopyAccelerator\.exe|svchost\.exe|tiworker\.exe)$`)
    )

  condition:
    $e
}