AN1626
Analytic 1626
Windows
Detects attempts to modify file timestamps via API usage (e.g., `SetFileTime`), CLI tools (e.g., `w32tm`, PowerShell), or double-timestomp behavior where $SI and $FN timestamps are mismatched or reverted.
WinEventLog:Sysmon
EventCode=15
WinEventLog:Security
EventCode=4663, 4670, 4656
EDR:file
SetFileTime
[TimeWindow]
Correlate timestamp change with preceding file creation or suspicious access
[APINamePattern]
Include SetFileTime, NtSetInformationFile, or other timestamp APIs
[TimestampDeltaThreshold]
Trigger on excessive backdating (e.g., >90 days)
AN1627
Analytic 1627
Linux
Detects use of timestamp-altering commands like `touch -a -m -t` or `touch -r`, particularly when executed by unusual users or in suspicious directories.
auditd:SYSCALL
execve
linux:osquery
file_events
[MonitoredCommandList]
Commands like `touch -r`, `debugfs`, `stat` used in sequence
[FilePathRegex]
Suspicious paths like `/tmp/`, `/var/lib/`, `/mnt/esxi/`
[DeltaThreshold]
Mismatch between timestamp and file activity time
AN1628
Analytic 1628
macOS
Detects timestamp changes using `touch`, `SetFile`, or direct metadata tampering (e.g., xattr manipulation) from Terminal, scripts, or low-level APIs.
macos:unifiedlog
log stream --predicate
macos:osquery
file_events
[CommandMatch]
Touch/setfile and backdated timestamps
[UserContext]
Detects execution under non-interactive/system accounts
AN1629
Analytic 1629
ESXi
Detects abuse of busybox commands (e.g., `touch`) or log timestamp tampering during backdoor persistence or evasion.
esxi:vmkernel
/var/log/vmkernel.log
[TimestampAgeComparison]
Unusual backdating to match legit files
[PersistenceOverlap]
Overlap with known persistence paths