Suspicious File Time Attribute Change (via process_creation)

title: Suspicious File Time Attribute Change (via process_creation)
id: c04455be-7cf5-5d41-aa9b-e70e0534c7ee
status: stable
description: This rule detects file time attribute change to hide new or changes to existing files
references:
    - https://attack.mitre.org/techniques/T1070/006/
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.006/T1070.006.md
author: Huntrule Team
date: 2026-05-24
tags:
    - attack.stealth
    - attack.t1070.006
logsource:
    product: macos
    category: process_creation
detection:
    selection:
        Image|endswith: '/touch'
        CommandLine|contains:
            - '-t'
            - '-acmr'
            - '-d'
            - '-r'
    condition: selection
falsepositives:
    - Unknown
level: medium