huntrule

Linux Service File Touch with Timestamp Argument

Alerts when touch is executed with a timestamp flag on a .service file, indicating potential stealthy service manipulation.

FreeReviewedSigma · Medium · v2
Product
linux
Category
process_creation
Author
Joseliyo Sanchez, @Joseliyo_Jstnk (SigmaHQ), DRL 1.1
Published
2023-01-11
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies Linux process activity where the binary path ends with /touch and the command line includes a timestamp argument (' -t ') while targeting a .service file. Attackers may use touch to modify service file modification times or staging artifacts as part of stealthy persistence or configuration changes. It relies on process creation telemetry, specifically the process image path suffix and command line contents.

Reporting behind it

Related detections8 linkedT1070.006 — drag to rearrange
Suspicious File Timestamp Manipulation via PowerShell (via process_creation)
Suspicious System Time Changed (via security)
Suspicious Timestomping of PHP Webshell in Ivanti CSA Webroot via touch (via process_creation)
Windows File Creation Time Altered to a Previous Year
PowerShell timestomping via file timestamp property and setter usage (Windows)
macOS process using touch to modify file timestamps and hide file changes
Linux: Detect touch commands used to alter file timestamps with -t/-a/-c/-m/-r flags
Windows Security Event 4616 for System Time Changes by Non-Service Accounts
Linux Service File Touch with Timestamp Argument
Pivot detection · T1070.006 · 8 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.