Linux Service File Touch with Timestamp Argument

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1070.006Timestomp
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies Linux process activity where the binary path ends with /touch and the command line includes a timestamp argument (' -t ') while targeting a .service file. Attackers may use touch to modify service file modification times or staging artifacts as part of stealthy persistence or configuration changes. It relies on process creation telemetry, specifically the process image path suffix and command line contents.

Reporting behind it

Related detections8 linkedT1070.006 — drag to rearrange

Suspicious File Timestamp Manipulation via PowerShell (via process_creation)

Suspicious System Time Changed (via security)

Suspicious Timestomping of PHP Webshell in Ivanti CSA Webroot via touch (via process_creation)

Windows File Creation Time Altered to a Previous Year

PowerShell timestomping via file timestamp property and setter usage (Windows)

macOS process using touch to modify file timestamps and hide file changes

Linux: Detect touch commands used to alter file timestamps with -t/-a/-c/-m/-r flags

Windows Security Event 4616 for System Time Changes by Non-Service Accounts

Linux Service File Touch with Timestamp Argument

Pivot detection · T1070.006 · 8 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-process-creation-detect-touch-used-on-service-files-31545105

title: Linux Service File Touch with Timestamp Argument
id: 83cbd192-3737-4ca7-875e-5770963459c6
status: test
description: This rule identifies Linux process activity where the binary path ends with /touch and the command line includes a timestamp argument (' -t ') while targeting a .service file. Attackers may use touch to modify service file modification times or staging artifacts as part of stealthy persistence or configuration changes. It relies on process creation telemetry, specifically the process image path suffix and command line contents.
references:
  - https://blogs.blackberry.com/
  - https://twitter.com/Joseliyo_Jstnk/status/1620131033474822144
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_touch_susp.yml
author: Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule Team
date: 2023-01-11
tags:
  - attack.stealth
  - attack.t1070.006
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    Image|endswith: /touch
    CommandLine|contains: " -t "
    CommandLine|endswith: .service
  condition: selection
falsepositives:
  - Admin changing date of files.
level: medium
license: DRL-1.1
related:
  - id: 31545105-3444-4584-bebf-c466353230d2
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL