Timestamp Manipulation (PowerShell)

id: '8961.24525'
title: Timestamp Manipulation
description: 'Adversaries may modify file time attributes to hide new or changes to
  existing files. Timestomping is a technique that modifies the timestamps of a file
  (the modify, access, create, and change times), often to mimic files that are in
  the same folder. Threat Actor Association: WatchDog Atomics T1070.006 Test #1 Atomics
  T1070.006 Test #2 Atomics T1070.006 Test #3 Atomics T1070.006 Test #4 Atomics T1070.006
  Test #5 Atomics T1070.006 Test #6 Atomics T1070.006 Test #7 Atomics T1070.006 Test
  #8'
logic_format: Splunk
logic: ' `get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103)
  OR "<EventID>4103<" OR TERM(EventCode=4104) OR "<EventID>4104<") "CreationTime"
  OR "LastWriteTime" OR "LastAccessTime" OR "timestomp" | regex process="(?i)\.(Creation|Last(Write|Access))Time\s+?=|timestomp"
  | table _time, host, user, process* | bin span=1s | stats values(*) as * by _time,
  host `hec_collect`'
techniques:
- defense-evasion:indicator removal:timestomp
technique_id:
- T1070.006
data_category:
- PowerShell logs
references:
- https://www.cadosecurity.com/coinstomp-malware-family-targets-asian-cloud-service-providers/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.006/T1070.006.md