Detect Timestomp in IBM QRadar
Adversaries modify file timestamps (creation, modification, access, and metadata change times) to make malicious files blend in with legitimate system files or appear to predate the intrusion. On Windows, NTFS stores timestamps in both the $STANDARD_INFORMATION ($SI) attribute (user-visible, modifiable via Win32 API SetFileTime) and the $FILE_NAME ($FN) attribute (kernel-maintained, requires kernel interaction or file move/rename to modify). Most timestomping modifies only $SI, creating a detectable discrepancy between $SI and $FN — a key forensic indicator. Cobalt Strike's timestomp command, Meterpreter's timestomp module, and purpose-built tools target $SI timestamps. Advanced actors (APT28, APT29) perform double timestomping of both attributes. On Linux/macOS, the touch command (-a -m -t or -r flags) sets file timestamps. Actors using timestomping: APT28, APT38, APT32, APT5, UNC3886 (ESXi), Cobalt Strike, Stuxnet, Kimsuky, BlackByte 2.0.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Technique
- T1070 Indicator Removal
- Sub-technique
- T1070.006 Timestomp
- Canonical reference
- https://attack.mitre.org/techniques/T1070/006/
QRadar Detection Query
SELECT
DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
logsourcename(logsourceid) AS log_source,
username,
sourceip,
QIDNAME(qid) AS event_name,
"Process Name" AS process_name,
"Command" AS command_line,
"Parent Process Name" AS parent_process,
CATEGORYNAME(category) AS category_name
FROM events
WHERE LOGSOURCETYPEID(logsourceid) IN (12, 13, 229)
AND devicetime > (CURRENT_TIMESTAMP - 86400000)
AND (
("Process Name" ILIKE '%powershell.exe' OR "Process Name" ILIKE '%pwsh.exe')
AND ("Command" ILIKE '%SetLastWriteTime%'
OR "Command" ILIKE '%SetCreationTime%'
OR "Command" ILIKE '%SetLastAccessTime%'
OR ("Command" ILIKE '%[System.IO.File]%' AND "Command" ILIKE '%Time%'))
)
OR (
"Process Name" ILIKE '%touch'
AND ("Command" ILIKE '% -t %'
OR "Command" ILIKE '% -r %'
OR "Command" ILIKE '%--time=%')
)
OR "Process Name" ILIKE '%timestomp.exe'
OR "Process Name" ILIKE '%BTimeStomp.exe'
OR (
"Process Name" ILIKE '%cmd.exe'
AND ("Command" ILIKE '%timestomp%'
OR "Command" ILIKE '%SetCreationTime%'
OR "Command" ILIKE '%SetLastWriteTime%')
)
ORDER BY devicetime DESC
LIMIT 500Detects timestomping activity by monitoring process execution events for PowerShell SetFileTime API calls, Linux/macOS touch commands with timestamp flags, known timestomping tools, and cmd.exe invoking timestomp operations. Uses QRadar event data from Windows Sysmon, Windows Security, and endpoint sources.
Data Sources
Required Tables
False Positives & Tuning
- Automated software deployment or CI/CD pipelines using PowerShell to set file timestamps during artifact packaging
- Forensic investigation tools (e.g., FTK, Autopsy) that may invoke touch or SetFileTime when restoring evidence images
- Cross-platform build tools that use touch on Unix-like systems to force recompilation of artifacts
Other platforms for T1070.006
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Timestomp Windows File via PowerShell SetFileTime
Expected signal: Sysmon EventCode 2 (FileCreateTime): records the file creation time change from actual creation time to 2010-01-01 00:00:00 UTC, including both PreviousCreationUtcTime and CreationUtcTime fields. PowerShell process creation with SetCreationTime in command line. MDE DeviceFileEvents with ActionType=FileModified. The $SI vs $FN discrepancy is detectable via MFT analysis tools.
- Test 2Timestomp Linux File with touch -t
Expected signal: Linux auditd EXECVE record for touch with -a -m -t 201501010000.00 arguments. Process creation event for touch command with timestamp modification flags and target file path. The file's atime and mtime will be set to 2015-01-01 00:00:00 while the inode change time (ctime) records the actual modification time — the ctime discrepancy is a forensic indicator.
- Test 3Copy File Timestamp from Legitimate System File
Expected signal: Sysmon EventCode 2 (FileCreateTime) for the test file showing the creation time changing to kernel32.dll's creation time. PowerShell process creation with CreationTime and LastWriteTime property assignments. The $FN attribute in the MFT retains the actual creation time of the test file despite $SI being modified to match kernel32.dll.
References (5)
- https://attack.mitre.org/techniques/T1070/006/
- https://www.inversecos.com/2022/04/defence-evasion-technique-timestomping-detection-ntfs-forensics.html
- https://www.inversecos.com/2022/08/detecting-linux-anti-forensics.html
- https://www.magnetforensics.com/blog/expose-evidence-of-timestomping-with-the-ntfs-timestamp-mismatch-artifact/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.006/T1070.006.md
Unlock Pro Content
Get the full detection package for T1070.006 including response playbook, investigation guide, and atomic red team tests.