Techniques › T1070.006 › AN1627
AN1627 Analytic 1627
Linux · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detects use of timestamp-altering commands like
touch -a -m -t or touch -r, particularly when executed by unusual users or in suspicious directories.</p>- Detects
- T1070.006 Timestomp
- Part of
- DET0591 Cross-Platform Behavioral Detection of File Timestomping via Metadata Tampering
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| auditd:SYSCALL | execve | DC0032 Process Creation |
| linux:osquery | file_events | DC0059 File Metadata |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
MonitoredCommandList | Commands like `touch -r`, `debugfs`, `stat` used in sequence |
FilePathRegex | Suspicious paths like `/tmp/`, `/var/lib/`, `/mnt/esxi/` |
DeltaThreshold | Mismatch between timestamp and file activity time |