Linux: Detect touch commands used to alter file timestamps with -t/-a/-c/-m/-r flags

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1070.006Timestomp
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies Linux processes running touch with timestamp-related parameters that can change file access and/or modification times. Attackers may use timestamp manipulation to hide the creation or modification time of files. The detection relies on auditd EXECVE telemetry capturing the touch command and its specific -t, -acmr, -d, and -r arguments.

Reporting behind it

Related detections8 linkedT1070.006 — drag to rearrange

Suspicious File Timestamp Manipulation via PowerShell (via process_creation)

Suspicious System Time Changed (via security)

Suspicious Timestomping of PHP Webshell in Ivanti CSA Webroot via touch (via process_creation)

Linux Service File Touch with Timestamp Argument

Windows File Creation Time Altered to a Previous Year

PowerShell timestomping via file timestamp property and setter usage (Windows)

macOS process using touch to modify file timestamps and hide file changes

Windows Security Event 4616 for System Time Changes by Non-Service Accounts

Linux: Detect touch commands used to alter file timestamps with -t/-a/-c/-m/-r flags

Pivot detection · T1070.006 · 8 related

Changelog

v3

v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-auditd-file-timestamp-manipulation-via-touch-t-a-c-m-r-options-b3cec4e7

title: "Linux: Detect touch commands used to alter file timestamps with -t/-a/-c/-m/-r flags"
id: 7bf04cc5-9676-48c1-92ca-9c6b2b52d7c3
status: test
description: This rule identifies Linux processes running touch with timestamp-related parameters that can change file access and/or modification times. Attackers may use timestamp manipulation to hide the creation or modification time of files. The detection relies on auditd EXECVE telemetry capturing the touch command and its specific -t, -acmr, -d, and -r arguments.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.006/T1070.006.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/execve/lnx_auditd_change_file_time_attr.yml
author: Igor Fits, oscd.community, Huntrule Team
date: 2020-10-15
modified: 2022-11-28
tags:
  - attack.stealth
  - attack.t1070.006
logsource:
  product: linux
  service: auditd
detection:
  execve:
    type: EXECVE
  touch:
    - touch
  selection2:
    - -t
    - -acmr
    - -d
    - -r
  condition: execve and touch and selection2
falsepositives:
  - Unknown
level: medium
simulation:
  - type: atomic-red-team
    name: Set a file's access timestamp
    technique: T1070.006
    atomic_guid: 5f9113d5-ed75-47ed-ba23-ea3573d05810
  - type: atomic-red-team
    name: Set a file's modification timestamp
    technique: T1070.006
    atomic_guid: 20ef1523-8758-4898-b5a2-d026cc3d2c52
  - type: atomic-red-team
    name: Modify file timestamps using reference file
    technique: T1070.006
    atomic_guid: 631ea661-d661-44b0-abdb-7a7f3fc08e50
license: DRL-1.1
related:
  - id: b3cec4e7-6901-4b0d-a02d-8ab2d8eb818b
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL