PowerShell Timestomping via File Attribute Modification - T1070.006

Ankit Mehta@Secvyn

•updated Jun 29, 2026•1•0•1

Detects the use of PowerShell commands that modify file system metadata (e.g., CreationTime, LastWriteTime, LastAccessTime). This technique, often referred to as 'timestomping', is used by adversaries to manipulate file timestamps to evade detection or hide activity.