T1070.006: Timestomp — MITRE ATT&CK Technique

Description

Adversaries may modify file time attributes to hide new files or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder and blend malicious files with legitimate files.

In Windows systems, both the $STANDARD_INFORMATION ($SI) and $FILE_NAME ($FN) attributes record times in a Master File Table (MFT) file.(Citation: Inversecos Timestomping 2022) $SI (dates/time stamps) is displayed to the end user, including in the File System view, while $FN is dealt with by the kernel.(Citation: Magnet Forensics)

Modifying the $SI attribute is the most common method of timestomping because it can be modified at the user level using API calls. $FN timestomping, however, typically requires interacting with the system kernel or moving or renaming a file.(Citation: Inversecos Timestomping 2022)

Adversaries modify timestamps on files so that they do not appear conspicuous to forensic investigators or file analysis tools. In order to evade detections that rely on identifying discrepancies between the $SI and $FN attributes, adversaries may also engage in “double timestomping” by modifying times on both attributes simultaneously.(Citation: Double Timestomping)

In Linux systems and on ESXi servers, threat actors may attempt to perform timestomping using commands such as touch -a -m -t (which sets access and modification times to a specific value) or touch -r (which sets access and modification times to match those of another file).(Citation: Inversecos Linux Timestomping)(Citation: Juniper Networks ESXi Backdoor 2022)

Timestomping may be used along with file name Masquerading to hide malware and tools.(Citation: WindowsIR Anti-Forensic Techniques)

Platforms

ESXiLinuxmacOSWindows

Threat Groups (11)

ID	Group	Context
G0082	APT38	[APT38](https://attack.mitre.org/groups/G0082) has modified data timestamps to mimic files that are in the same folder on a compromised host.(Citation...
G0094	Kimsuky	[Kimsuky](https://attack.mitre.org/groups/G0094) has manipulated timestamps for creation or compilation dates to defeat anti-forensics.(Citation: Cybe...
G0050	APT32	[APT32](https://attack.mitre.org/groups/G0050) has used scheduled task raw XML with a backdated timestamp of June 2, 2016. The group has also set the ...
G0129	Mustang Panda	[Mustang Panda](https://attack.mitre.org/groups/G0129) has modified file timestamps from the export address table (EAT) in malware to make it difficul...
G0106	Rocke	[Rocke](https://attack.mitre.org/groups/G0106) has changed the time stamp of certain files.(Citation: Anomali Rocke March 2019)
G1048	UNC3886	[UNC3886](https://attack.mitre.org/groups/G1048) has used scripts to timestomp ESXi hosts prior to installing malicious vSphere Installation Bundles (...
G0016	APT29	[APT29](https://attack.mitre.org/groups/G0016) has used timestomping to alter the Standard Information timestamps on their web shells to match other f...
G0114	Chimera	[Chimera](https://attack.mitre.org/groups/G0114) has used a Windows version of the Linux <code>touch</code> command to modify the date and time stamp ...
G0007	APT28	[APT28](https://attack.mitre.org/groups/G0007) has performed timestomping on victim files.(Citation: Crowdstrike DNC June 2016)
G1023	APT5	[APT5](https://attack.mitre.org/groups/G1023) has modified file timestamps.(Citation: Mandiant Pulse Secure Update May 2021)
G0032	Lazarus Group	Several [Lazarus Group](https://attack.mitre.org/groups/G0032) malware families use timestomping, including modifying the last write timestamp of a sp...

Associated Software (44)

ID	Name	Type	Context
S0520	BLINDINGCAN	Malware	[BLINDINGCAN](https://attack.mitre.org/software/S0520) has modified file and directory timestamps.(Citation: US-CERT BLINDINGCAN Aug 2020)(Citation: N...
S1100	Ninja	Malware	[Ninja](https://attack.mitre.org/software/S1100) can change or create the last access or write times.(Citation: Kaspersky ToddyCat June 2022)
S0603	Stuxnet	Malware	[Stuxnet](https://attack.mitre.org/software/S0603) extracts and writes driver files that match the times of other legitimate files.(Citation: Nicolas ...
S0185	SEASHARPEE	Malware	[SEASHARPEE](https://attack.mitre.org/software/S0185) can timestomp files on victims using a Web shell.(Citation: FireEye APT34 Webinar Dec 2017)
S0164	TDTESS	Malware	After creating a new service for persistence, [TDTESS](https://attack.mitre.org/software/S0164) sets the file creation time for the service to the cre...
S0083	Misdat	Malware	Many [Misdat](https://attack.mitre.org/software/S0083) samples were programmed using Borland Delphi, which will mangle the default PE compile timestam...
S0239	Bankshot	Malware	[Bankshot](https://attack.mitre.org/software/S0239) modifies the time of a file as specified by the control server.(Citation: McAfee Bankshot)
S1164	UPSTYLE	Malware	[UPSTYLE](https://attack.mitre.org/software/S1164) restores timestamps to original values following modification.(Citation: Volexity UPSTYLE 2024)
S1226	BOOKWORM	Malware	[BOOKWORM](https://attack.mitre.org/software/S1226) has modified file timestamps from the export address table (EAT) to make it difficult to discern w...
S1031	PingPull	Malware	[PingPull](https://attack.mitre.org/software/S1031) has the ability to timestomp a file.(Citation: Unit 42 PingPull Jun 2022)
S1181	BlackByte 2.0 Ransomware	Malware	[BlackByte 2.0 Ransomware](https://attack.mitre.org/software/S1181) can timestomp files for defense evasion and anti-forensics purposes.(Citation: Mic...
S0260	InvisiMole	Malware	[InvisiMole](https://attack.mitre.org/software/S0260) samples were timestomped by the authors by setting the PE timestamps to all zero values. [Invisi...
S1149	CHIMNEYSWEEP	Malware	[CHIMNEYSWEEP](https://attack.mitre.org/software/S1149) can time stomp its executable, previously dating it between 2010 to 2021.(Citation: Mandiant R...
S0020	China Chopper	Malware	[China Chopper](https://attack.mitre.org/software/S0020)'s server component can change the timestamp of files.(Citation: FireEye Periscope March 2018)...
S0387	KeyBoy	Malware	[KeyBoy](https://attack.mitre.org/software/S0387) time-stomped its DLL in order to evade detection.(Citation: PWC KeyBoys Feb 2017)
S0150	POSHSPY	Malware	[POSHSPY](https://attack.mitre.org/software/S0150) modifies timestamps of all downloaded executables to match a randomly selected file created prior t...
S1135	MultiLayer Wiper	Malware	[MultiLayer Wiper](https://attack.mitre.org/software/S1135) changes timestamps of overwritten files to either 1601.1.1 for NTFS filesystems, or 1980.1...
S0081	Elise	Malware	[Elise](https://attack.mitre.org/software/S0081) performs timestomping of a CAB file it creates.(Citation: Lotus Blossom Jun 2015)
S0168	Gazer	Malware	For early [Gazer](https://attack.mitre.org/software/S0168) versions, the compilation timestamp was faked.(Citation: ESET Gazer Aug 2017)
S0066	3PARA RAT	Malware	[3PARA RAT](https://attack.mitre.org/software/S0066) has a command to set certain attributes such as creation/modification timestamps on files.(Citati...

References

Frequently Asked Questions

What is T1070.006 (Timestomp)?

T1070.006 is a MITRE ATT&CK technique named 'Timestomp'. It belongs to the Stealth tactic(s). Adversaries may modify file time attributes to hide new files or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change t...

How can T1070.006 be detected?

Detection of T1070.006 (Timestomp) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.

What mitigations exist for T1070.006?

Follow defense-in-depth principles including network segmentation, least privilege access, security monitoring, and regular patching to reduce the risk of this technique.

Which threat groups use T1070.006?

Known threat groups using T1070.006 include: APT38, Kimsuky, APT32, Mustang Panda, Rocke, UNC3886, APT29, Chimera.