Timestomping via PowerShell or CLI Timestamp Manipulation

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•2

Detects the use of PowerShell, PWSH, or CMD to modify file system timestamps, a technique commonly referred to as timestomping. This is often used by adversaries to hide malicious file activity or blend in with legitimate system files by manipulating file creation, modification, or access time metadata.