Detection of PowerShell-Based Timestomping Activity

Timestomping is an anti-forensics technique used by adversaries to manipulate the metadata of files, including creation, access, and modification (MAC) timestamps. By altering these attributes to match legitimate system files or to predate the actual time of an attack, threat actors aim to disrupt incident response timelines and evade detection by security tools relying on time-based file activity. This activity is frequently observed in PowerShell scripts, which leverage the .NET framework's System.IO.File class to directly modify these attributes. Defenders must monitor PowerShell Script Block logging (Event ID 4104) to identify these modifications, as the behavior is common in post-exploitation scenarios where adversaries attempt to blend malicious tools into established file directories.

Attack Chain

1. Attacker establishes an initial foothold on a Windows host using a malicious payload or script.
2. Attacker deploys a secondary implant or tool to the filesystem.
3. Attacker identifies the target file path on the local or network drive.
4. Attacker executes a PowerShell script block utilizing [IO.File]::SetLastWriteTime or similar .NET methods.
5. The file's metadata is updated, effectively hiding the actual modification time from standard file explorers and forensic tools.
6. Attacker proceeds with further post-exploitation activities such as privilege escalation or lateral movement.
7. Final objective is achieved, such as credential harvesting or exfiltration, with an obscured forensic trail.

Impact

Successful timestomping impacts incident response investigations by creating inaccurate timelines of attacker activity. This complicates the identification of malicious file creation times, making it difficult for responders to correlate events with specific infection windows or C2 communication, potentially allowing attackers to maintain persistence undetected.

Recommendation

Prioritize the implementation of PowerShell Script Block Logging (Event ID 4104) across all Windows endpoints to capture the commands executed by malicious scripts. Deploy the provided Sigma rule to your SIEM to alert on unauthorized metadata manipulation attempts.

• Enable PowerShell Script Block Logging (Event ID 4104) via Group Policy to ensure visibility into the commands used for file attribute modification.
• Deploy the following Sigma rule to detect the .NET file attribute modification methods commonly used in timestomping.
• Investigate any hits from this rule to differentiate between legitimate administrative maintenance and suspicious anti-forensics activity.