T1070.006: Timestomp
Adversaries may modify file time attributes to hide new files or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder and blend malicious files with legitimate files.
In Windows systems, both the `$STANDARD_INFORMATION` (`$SI`) and `$FILE_NAME` (`$FN`) attributes record times in a Master File Table (MFT) file.CitationInversecos Timestomping 2022 `$SI` (dates/time stamps) is displayed to the end user, including in the File System view, while `$FN` is dealt with by the kernel.CitationMagnet Forensics
Modifying the `$SI` attribute is the most common method of timestomping because it can be modified at the user level using API calls. `$FN` timestomping, however, typically requires interacting with the system kernel or moving or renaming a file.CitationInversecos Timestomping 2022
Adversaries modify timestamps on files so that they do not appear conspicuous to forensic investigators or file analysis tools. In order to evade detections that rely on identifying discrepancies between the `$SI` and `$FN` attributes, adversaries may also engage in “double timestomping” by modifying times on both attributes simultaneously.CitationDouble Timestomping
In Linux systems and on ESXi servers, threat actors may attempt to perform timestomping using commands such as `touch -a -m -t ` (which sets access and modification times to a specific value) or `touch -r ` (which sets access and modification times to match those of another file).CitationInversecos Linux TimestompingCitationJuniper Networks ESXi Backdoor 2022
Timestomping may be used along with file name Masquerading to hide malware and tools.CitationWindowsIR Anti-Forensic Techniques
Security context for executives and security teams
Timestomping matters because it attacks the timeline defenders rely on after an incident. By changing file timestamps on Windows, Linux, macOS, or ESXi systems, an adversary can make newly introduced or modified files look ordinary, older, or consistent with neighboring files. For leaders, the risk is not just a hidden file; it is reduced confidence in incident scoping, audit timelines, malware triage, and restoration decisions.
Executive priority
Prioritize this where file integrity, forensic readiness, and rapid incident reconstruction are business-critical: servers, ESXi hosts, web-facing systems, privileged administration paths, and systems supporting regulated or operationally sensitive functions. The ATT&CK relationships show this technique is used across multiple campaigns, groups, and malware families, so executives should ask whether the organization can independently validate file timelines rather than relying only on user-visible timestamps.
Technical view
T1070.006 is a stealth sub-technique of Indicator Removal. On Windows, teams should understand the distinction between NTFS $STANDARD_INFORMATION timestamps, which are commonly user-modifiable and visible in normal file views, and $FILE_NAME timestamps, which may provide comparison value but can also be altered through more involved methods or double timestomping. On Linux and ESXi, ATT&CK notes use of timestamp-setting behavior such as touch-style access and modification time changes. SOC and IR teams should validate cross-platform detection logic against metadata tampering, including the related ATT&CK detection strategy DET0591, while treating timestamp anomalies as investigative leads rather than standalone proof of compromise.
Likely telemetry
- File metadata from Windows NTFS, including $STANDARD_INFORMATION and $FILE_NAME timestamp fields where available
- Endpoint file creation, modification, rename, and move events
- Command execution telemetry for timestamp-changing utilities or API-driven file metadata changes
- Linux, macOS, and ESXi file access and modification timestamp records
- File integrity monitoring or baseline comparison data for sensitive directories
Detection direction
- Validate whether detections compare multiple timestamp sources rather than relying only on user-visible file times.
- Tune analytics for improbable timestamp patterns, timestamp alignment with many neighboring files, and mismatches between creation, modification, access, and change times.
- On Windows, include checks for $SI and $FN inconsistencies, while recognizing that double timestomping may reduce this signal.
- On Linux and ESXi, review command and file metadata evidence for explicit timestamp-setting behavior such as touch-style access and modification time changes.
- Correlate timestamp anomalies with file name masquerading, unexpected file placement, tool staging, web shell activity, or other suspicious host behavior when available.
Mitigation priorities
- Preserve high-value file metadata and forensic artifacts during incident response so timeline manipulation can be investigated later.
- Establish file integrity monitoring and known-good baselines for critical directories, administrative tooling locations, web server paths, and ESXi/Linux/Windows management areas.
- Limit unnecessary administrative access that can alter sensitive files and metadata, especially on servers and virtualization infrastructure.
- Ensure endpoint and server logging captures file operations, command execution, and metadata changes with sufficient retention for incident timelines.
- Use change-management evidence to distinguish authorized deployment or restore activity from suspicious timestamp manipulation.
Additional notes and limits
The most important defensive question is whether the organization can reconstruct a trustworthy sequence of file activity when an adversary intentionally makes timestamps misleading. ATT&CK links this technique to many groups, campaigns, and software entries, and also notes use with Masquerading, which makes directory context and naming patterns important during triage.
MITRE provides no official detection text for this object. Detection and mitigation recommendations here are derived only from the official description, platforms, tactics, external references, and relationship context. Local filesystem type, logging depth, EDR visibility, retention, and administrative practices will determine actual coverage.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Timestomp
Adversaries may modify file time attributes to hide new files or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder and blend malicious files with legitimate files.
In Windows systems, both the `$STANDARD_INFORMATION` (`$SI`) and `$FILE_NAME` (`$FN`) attributes record times in a Master File Table (MFT) file.CitationInversecos Timestomping 2022 `$SI` (dates/time stamps) is displayed to the end user, including in the File System view, while `$FN` is dealt with by the kernel.CitationMagnet Forensics
Modifying the `$SI` attribute is the most common method of timestomping because it can be modified at the user level using API calls. `$FN` timestomping, however, typically requires interacting with the system kernel or moving or renaming a file.CitationInversecos Timestomping 2022
Adversaries modify timestamps on files so that they do not appear conspicuous to forensic investigators or file analysis tools. In order to evade detections that rely on identifying discrepancies between the `$SI` and `$FN` attributes, adversaries may also engage in “double timestomping” by modifying times on both attributes simultaneously.CitationDouble Timestomping
In Linux systems and on ESXi servers, threat actors may attempt to perform timestomping using commands such as `touch -a -m -t ` (which sets access and modification times to a specific value) or `touch -r ` (which sets access and modification times to match those of another file).CitationInversecos Linux TimestompingCitationJuniper Networks ESXi Backdoor 2022
Timestomping may be used along with file name Masquerading to hide malware and tools.CitationWindowsIR Anti-Forensic Techniques
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
All related ATT&CK context
No relationships are available in the current normalized data for this object.
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.