T1070.006 Timestomp

Adversaries may modify file time attributes to hide new files or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder and blend malicious files with legitimate files. In Windows systems, both the `$STANDARD_INFORMATION` (`$SI`) and `$FILE_NAME` (`$FN`)…

MITRE ATT&CK page ↗

Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.