title: Powershell Timestomp
author: frack113
date: 2021/08/03
description: Adversaries may modify file time attributes to hide new or changes to
  existing files. Timestomping is a technique that modifies the timestamps of a file
  (the modify, access, create, and change times), often to mimic files that are in
  the same folder.
detection:
  SELECTION_1:
    EventID: 4104
  SELECTION_2:
    ScriptBlockText:
    - '*.CreationTime =*'
    - '*.LastWriteTime =*'
    - '*.LastAccessTime =*'
    - '*[IO.File]::SetCreationTime*'
    - '*[IO.File]::SetLastAccessTime*'
    - '*[IO.File]::SetLastWriteTime*'
  condition: (SELECTION_1 and SELECTION_2)
falsepositives:
- legitime admin script
id: c6438007-e081-42ce-9483-b067fbef33c3
level: medium
logsource:
  definition: EnableScriptBlockLogging must be set to enable
  product: windows
  service: powershell
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.006/T1070.006.md
- https://www.offensive-security.com/metasploit-unleashed/timestomp/
status: experimental
tags:
- attack.defense_evasion
- attack.t1070.006