T1070.006sub-technique of T1070 Indicator Removal

Timestomp

ESXi · Linux · macOS · Windows3 pieces on this siteT1070.006 on attack.mitre.org

Adversaries may modify file time attributes to hide new files or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder and blend malicious files with legitimate files. In Windows systems, both the `$STANDARD_INFORMATION` (`$SI`) and `$FILE_NAME` (`$FN`) attributes record times in a Master File Table (MFT) file.
MITRE ATT&CK 19.2, retrieved 2026-09-12

The evidence it leaves

Where the traces live, and what each source proves and does not.

Artifact reference

$MFT and the timestamp pair

T1070.006

Read

Analyses, case studies, guides, references and interview questions.

GuideMembers

The operator set the clock, and set only one of them

Timestomping is a decision, not an accident, and the decision is visible. NTFS keeps eight timestamps per file and the ordinary Windows API writes four of them. What the other four say about the tool the operator chose, the checklist they were working from, and where they stopped.

T1070.006T1070

ReferenceCONSTRUCTED

Forensic timeline cheat sheet: which clock, whose time zone, and what each timestamp really records

A timeline is only as good as your understanding of what each timestamp means. The artifacts that carry time on Windows, what event each one actually records, the zone it is stored in, and the commands to build and cut a super timeline.

T1070.006T1070.004

how MITRE says to see it

Cross-Platform Behavioral Detection of File Timestomping via Metadata Tampering

Detects attempts to modify file timestamps via API usage (e.g., `SetFileTime`), CLI tools (e.g., `w32tm`, PowerShell), or double-timestomp behavior where $SI and $FN timestamps are mismatched or reverted.
Detects use of timestamp-altering commands like `touch -a -m -t` or `touch -r`, particularly when executed by unusual users or in suspicious directories.
Detects timestamp changes using `touch`, `SetFile`, or direct metadata tampering (e.g., xattr manipulation) from Terminal, scripts, or low-level APIs.
Detects abuse of busybox commands (e.g., `touch`) or log timestamp tampering during backdoor persistence or evasion.

the rest of T1070

T1070.003 Clear Command History · not covered yet
T1070.004 File Deletion · 6 on this site
T1070.005 Network Share Connection Removal · not covered yet
T1070.007 Clear Network Connection History and Configurations · not covered yet
T1070.008 Clear Mailbox Data · not covered yet
T1070.009 Clear Persistence · not covered yet
T1070.010 Relocate Malware · not covered yet

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.