CmdID

CmdID / Techniques / T1070

T1070.006 Indicator Removal: Timestomp

Adversaries may modify file time attributes to hide new files or changes to existing files. MITRE ATT&CK

2 Sigma rules T1070.006 on attack.mitre.org

Part of

MITRE ATT&CK
T1070Indicator Removal

Sigma rules tagged with it

process creation, the highest levels first
mediumFile Time Attribute ChangeIgor Fits, Mikhail Larin, oscd.community · macOS
mediumTouch Suspicious Service FileJoseliyo Sanchez, @Joseliyo_Jstnk · Linux

Command lines CmdID reads as it

everyday examples from tldr-pages, CC BY 4.0

Set the file time to a specific value and don't create file if it doesn't exist on the page for touch

touch --no-create -t YYYYMMDDHHMM.SS path/to/file1 path/to/file2 ...Identify

Set the files' timestamp to the reference file's timestamp, and do not create the file if it does not exist on the page for touch

touch --no-create --reference path/to/reference_file path/to/file1 path/to/file2 ...Identify

Set the timestamp by parsing a string on the page for touch

touch --date "last year|5 hours|next thursday|nov 14|..." path/to/fileIdentify

An example is here when CmdID’s reading of it names T1070.006: a Sigma rule it trips is tagged with it, or its abuse is documented as it.