File Timestomping via Invoke-TimeStomp, fsutil, or Unsigned Process (T1070.006)

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•2

Detects evidence of file timestomping, a technique used by attackers to modify file system timestamps (Create, Access, Modify, Change) to evade forensic detection or masquerade malicious files. The rule monitors for explicit usage of timestomping tools (e.g., Invoke-TimeStomp), abuse of system utilities like fsutil.exe for timestamp modification by suspicious parent processes, and unauthorized or unsigned processes performing timestamp modification on sensitive file types.