macOS process using touch to modify file timestamps and hide file changes

Flags on macOS touch indicating file timestamp attribute changes for stealthy file activity.

FreeReviewedSigma · Medium · v2

Product: macos
Category: process_creation
Author: Igor Fits, Mikhail Larin, oscd.community (SigmaHQ), DRL 1.1
Published: 2020-10-19
Updated: 2026-07-31

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1070.006Timestomp
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies macOS process executions of the touch utility with arguments used to set or alter file time attributes. Attackers may use timestamp manipulation to make newly created or modified files appear older and reduce investigation visibility. The detection relies on process creation telemetry, matching the executed image path ending with /touch and the presence of specific timestamp-related flags in the command line.

Reporting behind it

Related detections8 linkedT1070.006 — drag to rearrange

Suspicious File Timestamp Manipulation via PowerShell (via process_creation)

Suspicious System Time Changed (via security)

Suspicious Timestomping of PHP Webshell in Ivanti CSA Webroot via touch (via process_creation)

Linux Service File Touch with Timestamp Argument

Windows File Creation Time Altered to a Previous Year

PowerShell timestomping via file timestamp property and setter usage (Windows)

Linux: Detect touch commands used to alter file timestamps with -t/-a/-c/-m/-r flags

Windows Security Event 4616 for System Time Changes by Non-Service Accounts

macOS process using touch to modify file timestamps and hide file changes

Pivot detection · T1070.006 · 8 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

macos-touch-timestamp-attribute-modification-via-command-line-88c0f9d8

title: macOS process using touch to modify file timestamps and hide file changes
id: c9a8288b-e09d-4c75-ab6a-a11698410f8c
status: test
description: This rule identifies macOS process executions of the touch utility with arguments used to set or alter file time attributes. Attackers may use timestamp manipulation to make newly created or modified files appear older and reduce investigation visibility. The detection relies on process creation telemetry, matching the executed image path ending with /touch and the presence of specific timestamp-related flags in the command line.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.006/T1070.006.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_change_file_time_attr.yml
author: Igor Fits, Mikhail Larin, oscd.community, Huntrule Team
date: 2020-10-19
modified: 2022-01-12
tags:
  - attack.stealth
  - attack.t1070.006
logsource:
  product: macos
  category: process_creation
detection:
  selection:
    Image|endswith: /touch
    CommandLine|contains:
      - -t
      - -acmr
      - -d
      - -r
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 88c0f9d8-30a8-4120-bb6b-ebb54abcf2a0
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL