huntrule

Linux: Detect touch commands used to alter file timestamps with -t/-a/-c/-m/-r flags

Alerts on touch executions with timestamp options that alter file access and modification times on Linux.

FreeReviewedSigma · Medium · v3
Product
linux
Service
auditd
Author
Igor Fits, oscd.community (SigmaHQ), DRL 1.1
Published
2020-10-15
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies Linux processes running touch with timestamp-related parameters that can change file access and/or modification times. Attackers may use timestamp manipulation to hide the creation or modification time of files. The detection relies on auditd EXECVE telemetry capturing the touch command and its specific -t, -acmr, -d, and -r arguments.

Reporting behind it

Related detections8 linkedT1070.006 — drag to rearrange
Suspicious File Timestamp Manipulation via PowerShell (via process_creation)
Suspicious System Time Changed (via security)
Suspicious Timestomping of PHP Webshell in Ivanti CSA Webroot via touch (via process_creation)
Linux Service File Touch with Timestamp Argument
Windows File Creation Time Altered to a Previous Year
PowerShell timestomping via file timestamp property and setter usage (Windows)
macOS process using touch to modify file timestamps and hide file changes
Windows Security Event 4616 for System Time Changes by Non-Service Accounts
Linux: Detect touch commands used to alter file timestamps with -t/-a/-c/-m/-r flags
Pivot detection · T1070.006 · 8 related

Changelog

v3
  1. v3
    Candidate ingested via manual entry.2026-07-31
  2. v2
    Candidate ingested via manual entry.2026-07-31
  3. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.