PowerShell Timestomp via File Timestamp Modification

Identifies PowerShell timestomping attempts by matching script text that sets file creation, access, and write timestamps.

FreeUnreviewedSigmamediumv1

powershell-timestomp-via-file-timestamp-modification-c6438007

title: PowerShell Timestomp via File Timestamp Modification
id: a0f7a1d4-e82b-4b75-86e7-d2dc12fe8754
status: test
description: This rule flags PowerShell scripts that reference common timestomping operations by setting file CreationTime, LastWriteTime, and LastAccessTime, including [IO.File]::Set* methods. Attackers use timestamp modification to obscure evidence of file creation or changes and make activity blend with existing files. Detection relies on Script Block Logging telemetry matching these specific timestamp assignment and setter patterns in PowerShell script text.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.006/T1070.006.md
  - https://www.offensive-security.com/metasploit-unleashed/timestomp/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_timestomp.yml
author: frack113, Huntrule Team
date: 2021-08-03
modified: 2022-12-25
tags:
  - attack.stealth
  - attack.t1070.006
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection_ioc:
    ScriptBlockText|contains:
      - .CreationTime =
      - .LastWriteTime =
      - .LastAccessTime =
      - "[IO.File]::SetCreationTime"
      - "[IO.File]::SetLastAccessTime"
      - "[IO.File]::SetLastWriteTime"
  condition: selection_ioc
falsepositives:
  - Legitimate admin script
level: medium
license: DRL-1.1
related:
  - id: c6438007-e081-42ce-9483-b067fbef33c3
    type: derived

What it detects

This rule flags PowerShell scripts that reference common timestomping operations by setting file CreationTime, LastWriteTime, and LastAccessTime, including [IO.File]::Set* methods. Attackers use timestamp modification to obscure evidence of file creation or changes and make activity blend with existing files. Detection relies on Script Block Logging telemetry matching these specific timestamp assignment and setter patterns in PowerShell script text.

Known false positives

Legitimate admin script

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.