File timestamps rewritten via touch time flags or debugfs

Siemphony@siemphonylowT1070.006unverified

Matches process creation on Linux where `touch` is invoked with a flag that sets a timestamp to something other than "now" — an explicit time (`-t`), an explicit date (`-d`/`--date`), or another file's times copied across (`-r`/`--reference`) — plus the clustered short-flag forms (`-amt`, `-mr`, `-ad` and friends) that the same command is usually written with. The binary gate and the flag gate are separate selections that must both hold, because bare `touch file` only stamps the current time and is one of the most common commands on any Linux host; it is the flag that turns the invocation into timestomping. A second, independent selection covers `debugfs` carrying `set_inode_field`, which writes inode times directly and bypasses the utimensat path entirely. MITRE's `MonitoredCommandList` knob names `touch -r` and `debugfs`; the specific flag list above is authored here, not sourced from MITRE. This rule is written for the `process_creation` vocabulary over auditd `execve` records — `Image` holds the resolved `exe=` path and `CommandLine` the reconstructed `a0..aN` argument vector — and auditd emits no execve records at all until an `-a always,exit -F arch=b64 -S execve` rule is loaded, so an estate with stock auditd rules returns zero rows because it is blind, not because it is quiet. Three routes are invisible to it by construction: a timestamp set by calling `utimensat`/`utime` directly from compiled code or from `os.utime` in a script never creates a process; a BusyBox or toybox userland execs `/bin/busybox` rather than a path ending `/touch`; and the `$STANDARD_INFORMATION` versus `$FILE_NAME` discrepancy the technique description centres on is an NTFS artefact with no Linux equivalent, so the brief's Windows analytic AN1626 (Sysmon EventID 15 `create_stream_hash`, Security 4663/4670/4656) is a separate feed with its own field names and is not combined here. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0591, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((FolderPath endswith "/touch" and (ProcessCommandLine contains " -t " or ProcessCommandLine contains " -d " or ProcessCommandLine contains " -r " or ProcessCommandLine contains " --date" or ProcessCommandLine contains " --reference" or ProcessCommandLine contains " --time=" or ProcessCommandLine contains " -at " or ProcessCommandLine contains " -mt " or ProcessCommandLine contains " -amt " or ProcessCommandLine contains " -ar " or ProcessCommandLine contains " -mr " or ProcessCommandLine contains " -amr " or ProcessCommandLine contains " -ad " or ProcessCommandLine contains " -md " or ProcessCommandLine contains " -amd ")) or (FolderPath endswith "/debugfs" and ProcessCommandLine contains "set_inode_field"))

Splunk · SPL

Run this as a search.

index=* ((Image="*/touch" AND (CommandLine="* -t *" OR CommandLine="* -d *" OR CommandLine="* -r *" OR CommandLine="* --date*" OR CommandLine="* --reference*" OR CommandLine="* --time=*" OR CommandLine="* -at *" OR CommandLine="* -mt *" OR CommandLine="* -amt *" OR CommandLine="* -ar *" OR CommandLine="* -mr *" OR CommandLine="* -amr *" OR CommandLine="* -ad *" OR CommandLine="* -md *" OR CommandLine="* -amd *")) OR (Image="*/debugfs" AND CommandLine="*set_inode_field*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.executable) LIKE "*/touch" AND (TO_LOWER(process.command_line) LIKE "* -t *" OR TO_LOWER(process.command_line) LIKE "* -d *" OR TO_LOWER(process.command_line) LIKE "* -r *" OR TO_LOWER(process.command_line) LIKE "* --date*" OR TO_LOWER(process.command_line) LIKE "* --reference*" OR TO_LOWER(process.command_line) LIKE "* --time=*" OR TO_LOWER(process.command_line) LIKE "* -at *" OR TO_LOWER(process.command_line) LIKE "* -mt *" OR TO_LOWER(process.command_line) LIKE "* -amt *" OR TO_LOWER(process.command_line) LIKE "* -ar *" OR TO_LOWER(process.command_line) LIKE "* -mr *" OR TO_LOWER(process.command_line) LIKE "* -amr *" OR TO_LOWER(process.command_line) LIKE "* -ad *" OR TO_LOWER(process.command_line) LIKE "* -md *" OR TO_LOWER(process.command_line) LIKE "* -amd *")) OR (TO_LOWER(process.executable) LIKE "*/debugfs" AND TO_LOWER(process.command_line) LIKE "*set_inode_field*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,linux,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 2 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for linux so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)/touch$</field>    <field name="CommandLine" type="pcre2">(?i)( -t | -d | -r | --date| --reference| --time=| -at | -mt | -amt | -ar | -mr | -amr | -ad | -md | -amd )</field>    <description>File timestamps rewritten via touch time flags or debugfs (1/2)</description>    <mitre>      <id>T1070.006</id>    </mitre>  </rule>   <rule id="100001" level="5">    <!-- Set <if_sid> to the decoder/base rule for linux so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)/debugfs$</field>    <field name="CommandLine" type="pcre2">(?i)set_inode_field</field>    <description>File timestamps rewritten via touch time flags or debugfs (2/2)</description>    <mitre>      <id>T1070.006</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / linux
Level: low
Category: defense_evasion_clear_logs
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: ed4fd5cb-59a3-40fc-8c79-8f05f27c403b

ATT&CKT1070.006

T1070.006Timestomp

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessondefense evasion clear logs

defense evasion clear logsAI draft — unreviewed

01 · What this rule detects

AN1627 asks for timestamp-altering commands on Linux — touch -a -m -t, touch -r — and MITRE's MonitoredCommandList knob names touch -r and debugfs. The rule implements exactly that, as two independent arms. What it does not touch is the thing the technique description centres on. The $STANDARD_INFORMATION versus $FILE_NAME discrepancy is an NTFS artefact with no Linux equivalent, so the brief's Windows analytic AN1626 (Sysmon EventID 15 create_stream_hash, Security 4663/4670/4656) is a separate feed with its own field names and is deliberately not combined here.

02 · Telemetry you need

category: process_creation / product: linux, copied verbatim from AN1627, read over auditd execve records — Image holds the resolved exe= path, CommandLine the reconstructed a0..aN argument vector.
Auditd emits no execve records at all until an -a always,exit -F arch=b64 -S execve rule is loaded, and stock rulesets do not load one. On such an estate this rule returns zero rows because the host is blind, not because it is quiet. That is the failure mode worth naming before anyone reads an empty panel as good news.

03 · How the logic works

Arm one is two selections ANDed. selection_touch_binary is Image|endswith: '/touch'; selection_touch_time_flag is a fifteen-entry CommandLine|contains list. They are split on purpose: bare touch file only stamps the current time and is among the most common commands on any host, so the binary alone is worthless. The flag is what turns the invocation into timestomping. The list covers explicit time (' -t '), explicit date (' -d ', ' --date'), another file's times copied across (' -r ', ' --reference'), ' --time=', and the clustered short forms the command is usually typed with — ' -at ', ' -mt ', ' -amt ', ' -ar ', ' -mr ', ' -amr ', ' -ad ', ' -md ', ' -amd '. Only -r and the general shape come from MITRE; the fifteen patterns are authored here. Arm two, selection_debugfs, needs no partner: Image|endswith: '/debugfs' plus CommandLine|contains: 'set_inode_field' writes inode times directly and bypasses the utimensat path entirely.

04 · Common false positives

Build and packaging systems are the largest source by a wide margin on any developer, CI or build host. make recipes, rpmbuild, dpkg-buildpackage and reproducible-build wrappers call touch -r and touch -d @SOURCE_DATE_EPOCH to normalise mtimes, and nothing on the command line separates that from backdating a dropped file. Behind it: rsync/tar/cpio restore wrappers replaying original timestamps, and cron housekeeping that drops a touch -t marker then sweeps with find -newer. debugfs noise is rare but real — admins correcting a corrupt inode during an outage. level: low is honest given that first entry.

05 · Detection maturity

tier_1: , and it stays there. This rule was derived from a MITRE scaffold that contains no query logic and has never been run against a log line — reasoning that `touch -amt` would land in the list is analysis, not verification, and says nothing about the volume beneath it.
tier_2: confirm the execve audit rule is loaded, run read-only for a fortnight, and rank hits by parent and user.
tier_3: ** correlate a timestamp write against the file's own creation time, which is where MITRE's DeltaThreshold knob belongs.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Populate MITRE's FilePathRegex knob, which the rule leaves empty. Restricting the
Exclude by actor, not by flag: build accounts, CI runners and package-manager
Widen the flag matching. Every pattern requires a trailing space, but GNU getopt
Know the blind spots. utimensat/os.utime from code creates no process at all;

Declared by the author

Build and packaging systems, which are the single largest source of matches on any developer, CI or build host. make recipes, rpmbuild, dpkg-buildpackage and reproducible-build wrappers call touch -r and touch -d @SOURCE_DATE_EPOCH on generated artefacts to normalise mtimes and stop spurious rebuilds, and nothing on the command line separates that from an operator backdating a dropped file.
Backup, restore and sync tooling — rsync, tar, cpio and cp wrappers that call touch -r reference target to reapply original timestamps after a restore, and archive-extraction scripts that replay recorded mtimes onto unpacked files.
Housekeeping cron jobs and log-retention scripts that create a dated marker with touch -t or touch -d '7 days ago' and then sweep with find -newer marker, which produces a steady low-rate match on every server that runs one.
Filesystem repair and forensic-tooling work by administrators, where debugfs -w -R 'set_inode_field ...' is used to correct a corrupted inode on an unmounted ext filesystem, typically alongside fsck during an outage.

Noise check0 of 4 fired

Fires on none of the 4 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 4 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1070.006, evaluated against their process_creation events.

Share this rule

/u/siemphony/ed4fd5cb-59a3-40fc-8c79-8f05f27c403b

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

File timestamps rewritten via touch time flags or debugfs

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it