Windows File Creation Time Altered to a Previous Year
Alerts on Windows events where a file’s creation time is altered to a different year, excluding common benign system/update tooling.
- Product
- windows
- Category
- file_change
- Author
- frack113, Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-08-12
- Updated
- 2026-07-31
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows file-change events where the file creation timestamp appears to be modified to a year before 2020. Attackers may tamper with timestamps to hinder timeline analysis or make malicious artifacts appear to predate system activity. The detection relies on telemetry that records both previous and current file creation UTC times and supports exclusion of common legitimate modification scenarios from standard program and system locations.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows File Creation Time Altered to a Previous Year
id: 3996b7dd-4360-4e4b-b2a9-3bbf76379385
status: test
description: This rule flags Windows file-change events where the file creation timestamp appears to be modified to a year before 2020. Attackers may tamper with timestamps to hinder timeline analysis or make malicious artifacts appear to predate system activity. The detection relies on telemetry that records both previous and current file creation UTC times and supports exclusion of common legitimate modification scenarios from standard program and system locations.
references:
- https://www.inversecos.com/2022/04/defence-evasion-technique-timestomping.html
- https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/file/file_change/file_change_win_date_changed_to_another_year.yml
author: frack113, Florian Roth (Nextron Systems), Huntrule Team
date: 2022-08-12
modified: 2026-01-20
tags:
- attack.stealth
- attack.t1070.006
- detection.threat-hunting
logsource:
category: file_change
product: windows
detection:
selection:
PreviousCreationUtcTime|startswith: "202"
filter_main_creation_time:
CreationUtcTime|startswith: "202"
filter_main_program_files:
- TargetFilename|startswith:
- C:\Program Files\
- C:\Program Files (x86)\
- Image|startswith:
- C:\Program Files\
- C:\Program Files (x86)\
filter_optional_updates:
- Image:
- C:\Windows\system32\ProvTool.exe
- C:\Windows\System32\usocoreworker.exe
- C:\Windows\ImmersiveControlPanel\SystemSettings.exe
- TargetFilename|startswith: C:\ProgramData\USOPrivate\UpdateStore\
- TargetFilename|endswith:
- .tmp
- .temp
filter_optional_cab:
Image|startswith: C:\WINDOWS\System32\
Image|endswith:
- \TiWorker.exe
- \svchost.exe
- \sihclient.exe
TargetFilename|endswith: .cab
filter_optional_msiexec:
Image: C:\Windows\system32\msiexec.exe
filter_optional_vcredist:
Image|startswith: C:\Windows\Temp\
Image|endswith: \VCREDI~1.EXE
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
- Changes made to or by the local NTP service
- Software installations and updates
level: low
license: DRL-1.1
related:
- id: 558eebe5-f2ba-4104-b339-36f7902bcc1a
type: derived