Technique
№ 044 · class: evasion
Timestomping
Changing file timestamps to hide when they were created or modified.
Term
description · examples · notesChanging file timestamps to hide when they were created or modified.
Description
Targets creation, modification, access, and MFT entry times on NTFS.
Malicious files appear to have been present on the system for months or years.
Hinders forensic timeline analysis.
Tools like Timestomp or PowerShell can modify all four timestamps.
Examples
- Timestomp tool from the Metasploit framework
- PowerShell Set-ItemProperty to change CreationTime
Notes
- MFT $STANDARD_INFORMATION vs $FILE_NAME mismatch reveals timestomping.
Threats
used by 3Threats that use it. Select one to open its page.
Defenses
countered by 4How it is countered. Select one to open its page.