CmdID

CmdID / Commands

touch

Update the access and modification times of each FILE to the current time. toybox

On Linux 2 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Linux

from the toybox, 0BSD
touch [-amch] [-d DATE] [-t TIME] [-r FILE] FILE...
-aChange access time
-mChange modification time
-cDon't create file
-hChange symlink
-d DATESet time to DATE (in YYYY-MM-DDThh:mm:SS[.frac][tz] format)
-t TIMESet time to TIME (in [[CC]YY]MMDDhhmm[.ss][frac] format)
-r FILESet time same as reference FILE

Several platforms

from tldr-pages, CC BY 4.0

Create files and set access/modification times.

Create specific files or update their timestamps if they already exist

touch path/to/file1 path/to/file2 ...Identify

Set the file access or modification times to the current one and don't create file if it doesn't exist

touch --no-create -a path/to/file1 path/to/file2 ...Identify
-aChange access time toybox

Set the file time to a specific value and don't create file if it doesn't exist

touch --no-create -t YYYYMMDDHHMM.SS path/to/file1 path/to/file2 ...Identify
-tSet time to TIME (in [[CC]YY]MMDDhhmm[.ss][frac] format) toybox

Trips 1 Sigma rule: mediumFile Time Attribute Change by Igor Fits, Mikhail Larin, oscd.community

Set the files' timestamp to the reference file's timestamp, and do not create the file if it does not exist

touch --no-create --reference path/to/reference_file path/to/file1 path/to/file2 ...Identify

Trips 1 Sigma rule: mediumFile Time Attribute Change by Igor Fits, Mikhail Larin, oscd.community

Set the timestamp by parsing a string

touch --date "last year|5 hours|next thursday|nov 14|..." path/to/fileIdentify

Trips 1 Sigma rule: mediumFile Time Attribute Change by Igor Fits, Mikhail Larin, oscd.community

Create multiple files with an increasing number

touch path/to/file{1..10}Identify

Create multiple files with a letter range

touch path/to/file{a..z}Identify

What detects it

Sigma process creation rules that name touch
mediumFile Time Attribute ChangeIgor Fits, Mikhail Larin, oscd.community
mediumTouch Suspicious Service FileJoseliyo Sanchez, @Joseliyo_Jstnk