PowerShell timestomping via file timestamp property and setter usage (Windows)

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1070.006Timestomp
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags PowerShell script content that sets or assigns file timestamp properties and uses .NET methods to change file creation, last access, and last write times. Attackers may timestomp files to obscure activity by making timestamps appear consistent with existing files or normal activity. The detection relies on PowerShell Script Block Logging telemetry matching specific timestamp property and setter expressions.

Reporting behind it

Related detections8 linkedT1070.006 — drag to rearrange

Suspicious File Timestamp Manipulation via PowerShell (via process_creation)

Suspicious System Time Changed (via security)

Suspicious Timestomping of PHP Webshell in Ivanti CSA Webroot via touch (via process_creation)

Linux Service File Touch with Timestamp Argument

Windows File Creation Time Altered to a Previous Year

macOS process using touch to modify file timestamps and hide file changes

Linux: Detect touch commands used to alter file timestamps with -t/-a/-c/-m/-r flags

Windows Security Event 4616 for System Time Changes by Non-Service Accounts

PowerShell timestomping via file timestamp property and setter usage (Windows)

Pivot detection · T1070.006 · 8 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

powershell-timestomp-via-file-timestamp-modification-c6438007

title: PowerShell timestomping via file timestamp property and setter usage (Windows)
id: a0f7a1d4-e82b-4b75-86e7-d2dc12fe8754
status: test
description: This rule flags PowerShell script content that sets or assigns file timestamp properties and uses .NET methods to change file creation, last access, and last write times. Attackers may timestomp files to obscure activity by making timestamps appear consistent with existing files or normal activity. The detection relies on PowerShell Script Block Logging telemetry matching specific timestamp property and setter expressions.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.006/T1070.006.md
  - https://www.offensive-security.com/metasploit-unleashed/timestomp/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_timestomp.yml
author: frack113, Huntrule Team
date: 2021-08-03
modified: 2022-12-25
tags:
  - attack.stealth
  - attack.t1070.006
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection_ioc:
    ScriptBlockText|contains:
      - .CreationTime =
      - .LastWriteTime =
      - .LastAccessTime =
      - "[IO.File]::SetCreationTime"
      - "[IO.File]::SetLastAccessTime"
      - "[IO.File]::SetLastWriteTime"
  condition: selection_ioc
falsepositives:
  - Legitimate admin script
level: medium
license: DRL-1.1
related:
  - id: c6438007-e081-42ce-9483-b067fbef33c3
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL