Windows File Creation Time Altered to a Previous Year

title: Windows File Creation Time Altered to a Previous Year
id: 3996b7dd-4360-4e4b-b2a9-3bbf76379385
status: test
description: This rule flags Windows file-change events where the file creation timestamp appears to be modified to a year before 2020. Attackers may tamper with timestamps to hinder timeline analysis or make malicious artifacts appear to predate system activity. The detection relies on telemetry that records both previous and current file creation UTC times and supports exclusion of common legitimate modification scenarios from standard program and system locations.
references:
  - https://www.inversecos.com/2022/04/defence-evasion-technique-timestomping.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/file/file_change/file_change_win_date_changed_to_another_year.yml
author: frack113, Florian Roth (Nextron Systems), Huntrule Team
date: 2022-08-12
modified: 2026-01-20
tags:
  - attack.stealth
  - attack.t1070.006
  - detection.threat-hunting
logsource:
  category: file_change
  product: windows
detection:
  selection:
    PreviousCreationUtcTime|startswith: "202"
  filter_main_creation_time:
    CreationUtcTime|startswith: "202"
  filter_main_program_files:
    - TargetFilename|startswith:
        - C:\Program Files\
        - C:\Program Files (x86)\
    - Image|startswith:
        - C:\Program Files\
        - C:\Program Files (x86)\
  filter_optional_updates:
    - Image:
        - C:\Windows\system32\ProvTool.exe
        - C:\Windows\System32\usocoreworker.exe
        - C:\Windows\ImmersiveControlPanel\SystemSettings.exe
    - TargetFilename|startswith: C:\ProgramData\USOPrivate\UpdateStore\
    - TargetFilename|endswith:
        - .tmp
        - .temp
  filter_optional_cab:
    Image|startswith: C:\WINDOWS\System32\
    Image|endswith:
      - \TiWorker.exe
      - \svchost.exe
      - \sihclient.exe
    TargetFilename|endswith: .cab
  filter_optional_msiexec:
    Image: C:\Windows\system32\msiexec.exe
  filter_optional_vcredist:
    Image|startswith: C:\Windows\Temp\
    Image|endswith: \VCREDI~1.EXE
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Changes made to or by the local NTP service
  - Software installations and updates
level: low
license: DRL-1.1
related:
  - id: 558eebe5-f2ba-4104-b339-36f7902bcc1a
    type: derived