Windows File Creation Time Changed to an Earlier Year (Possible Timestomping)

title: Windows File Creation Time Changed to an Earlier Year (Possible Timestomping)
id: 3996b7dd-4360-4e4b-b2a9-3bbf76379385
status: test
description: This rule flags Windows file change events where the previous and current file creation timestamps begin with the year prefix "202" and the updated creation time is set to a different year. Attackers may manipulate file creation times to evade detection and make artifacts appear to have been installed earlier by the operating system. It relies on file change telemetry that includes previous and current creation UTC times, along with the target filename and the process image that performed the change, with exclusions for common benign system update and installer paths. This behavior is stealth-relevant because timestamp inconsistencies can be used to hide newly created or modified files.
references:
  - https://www.inversecos.com/2022/04/defence-evasion-technique-timestomping.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/file/file_change/file_change_win_date_changed_to_another_year.yml
author: frack113, Florian Roth (Nextron Systems), Huntrule Team
date: 2022-08-12
modified: 2026-01-20
tags:
  - attack.stealth
  - attack.t1070.006
  - detection.threat-hunting
logsource:
  category: file_change
  product: windows
detection:
  selection:
    PreviousCreationUtcTime|startswith: "202"
  filter_main_creation_time:
    CreationUtcTime|startswith: "202"
  filter_main_program_files:
    - TargetFilename|startswith:
        - C:\Program Files\
        - C:\Program Files (x86)\
    - Image|startswith:
        - C:\Program Files\
        - C:\Program Files (x86)\
  filter_optional_updates:
    - Image:
        - C:\Windows\system32\ProvTool.exe
        - C:\Windows\System32\usocoreworker.exe
        - C:\Windows\ImmersiveControlPanel\SystemSettings.exe
    - TargetFilename|startswith: C:\ProgramData\USOPrivate\UpdateStore\
    - TargetFilename|endswith:
        - .tmp
        - .temp
  filter_optional_cab:
    Image|startswith: C:\WINDOWS\System32\
    Image|endswith:
      - \TiWorker.exe
      - \svchost.exe
      - \sihclient.exe
    TargetFilename|endswith: .cab
  filter_optional_msiexec:
    Image: C:\Windows\system32\msiexec.exe
  filter_optional_vcredist:
    Image|startswith: C:\Windows\Temp\
    Image|endswith: \VCREDI~1.EXE
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Changes made to or by the local NTP service
  - Software installations and updates
level: low
license: DRL-1.1
related:
  - id: 558eebe5-f2ba-4104-b339-36f7902bcc1a
    type: derived