CmdID

CmdID / Rules / macOS

File Time Attribute Change

A Sigma rule for process creation on macOS, by Igor Fits, Mikhail Larin, oscd.community.

medium 1 ATT&CK technique 1 program it names 3 everyday examples trip it

What it looks for

its detection, as SigmaHQ writes it
detection:
  selection:
    CommandLine|contains:
      - '-t'
      - '-acmr'
      - '-d'
      - '-r'
    Image|endswith: '/touch'
  condition: selection

The rule’s detection, its selections and fields in order of name. The whole rule, with its references and false positives, is on SigmaHQ, by Igor Fits, Mikhail Larin, oscd.community, under the Detection Rule License 1.1. CmdID evaluates it on a command line alone: a test on what a command line cannot show, such as the parent process or the user, is not met.

Command lines that trip it

everyday examples from tldr-pages, CC BY 4.0, each read by CmdID

Set the file time to a specific value and don't create file if it doesn't exist on the page for touch

touch --no-create -t YYYYMMDDHHMM.SS path/to/file1 path/to/file2 ...Identify

Set the files' timestamp to the reference file's timestamp, and do not create the file if it does not exist on the page for touch

touch --no-create --reference path/to/reference_file path/to/file1 path/to/file2 ...Identify

Set the timestamp by parsing a string on the page for touch

touch --date "last year|5 hours|next thursday|nov 14|..." path/to/fileIdentify

Programs and files it names

their pages here
touch

ATT&CK

the techniques it is tagged with
T1070.006Indicator Removal: Timestomp

Other rules for T1070.006 Indicator Removal: Timestomp

Touch Suspicious Service File