macOS Touch Timestamp Attribute Modification via Command-Line

title: macOS Touch Timestamp Attribute Modification via Command-Line
id: c9a8288b-e09d-4c75-ab6a-a11698410f8c
status: test
description: This rule matches process creation events where the executed command is the touch utility and the command line includes specific flags used to set time-related attributes on files. Adversaries can use file timestamp modification to reduce the apparent recency of newly created or modified files and hinder investigations. Telemetry relies on macOS process creation logs including the image path and command-line arguments.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.006/T1070.006.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_change_file_time_attr.yml
author: Igor Fits, Mikhail Larin, oscd.community, Huntrule Team
date: 2020-10-19
modified: 2022-01-12
tags:
  - attack.stealth
  - attack.t1070.006
logsource:
  product: macos
  category: process_creation
detection:
  selection:
    Image|endswith: /touch
    CommandLine|contains:
      - -t
      - -acmr
      - -d
      - -r
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 88c0f9d8-30a8-4120-bb6b-ebb54abcf2a0
    type: derived