Sigma detection rules, expert-reviewed

Suspicious Timestomp via touch Reference Copy

This rule detects the touch command using the -r switch to copy timestamps from a reference file onto another file. Telecom network intruders timestomp their implants with touch -r so dropped files blend with legitimate system files. This behavior obscures the true creation time of attacker artifacts.

Suspicious Timestomp and Hidden Attribute Set on NTUSER Data File by EAGERBEE

This rule detects use of attrib to apply system, hidden, and archive attributes to a decoy ntusers0.dat file used by the EAGERBEE backdoor. The malware hides its staging file and manipulates attributes to blend with genuine user profile data. Setting these attributes on this specific file indicates indicator hiding.

Suspicious Timestomping of PHP Webshell in Ivanti CSA Webroot via touch (via process_creation)

This rule detects use of touch with an explicit date argument to backdate a PHP file inside the Ivanti Cloud Service Appliance LANDesk broker webroot, the timestomping behavior used by the Houken intrusion set to blend planted webshells with legitimate appliance files. Adversaries leverage timestamp manipulation to frustrate forensic triage, making this a strong signal of an attacker actively concealing webshell drops on the appliance.

PowerShell timestomping via file timestamp property and setter usage (Windows)

Identifies PowerShell timestomping attempts by matching script text that sets file creation, access, and write timestamps.