Timestomping a file

evasion_timestomp

Backdates the modification and access times of a sandbox file to 2009 and verifies the change, the standard anti-forensic step for making a dropped file blend into a system directory. Only files this test created are touched.

Severity medium how bad it would be if it were real

Expected outcome Something should notice

Platforms 3 macOS, Linux, Windows

Isolation subprocess runs in its own process, so a kill is a measurement

What it needs before it will run

runs in --safe
Observation only. It runs even in the inert mode, because it changes nothing and sends nothing.

Gates are cumulative and none of them is implied by another: see the three gates for why they are separate decisions.

ATT&CK techniques it exercises

MITRE ATT&CK techniques this test maps to.
Technique	Name	Tactic	Across public reports
T1070.006	Timestomp	Defense Evasion	coverage statistics

How often anything notices

Not enough data: fewer than 3 public reports have run this test, so no rate is published for it. Groups below that threshold are withheld everywhere on the site — with one or two contributors an average is one organisation's result with a percent sign after it.

Other defence evasion tests

Other tests in the Defence evasion category.
Test	What it does	Severity
Adding a Defender exclusion path evasion_defender_exclusion	Adds the sandbox directory to Microsoft Defender's exclusion list, verifies whether it took effect, and removes it again. Adding an exclusion is how c…	critical
Disabling Defender real-time monitoring evasion_defender_realtime_disable	Attempts to turn off Microsoft Defender's real-time monitoring through Set-MpPreference and turns it back on again. With tamper protection enabled thi…	critical
Stopping security services evasion_security_service_stop	Identifies which EDR/AV/telemetry services are actually running on this host and attempts to stop up to three of them, then restarts them. Tamper prot…	critical
In-memory AMSI bypass attempt evasion_amsi_bypass_attempt	Runs the published AMSI bypass one-liner in PowerShell and then feeds AMSI's own test string through Invoke-Expression, to establish whether script sc…	high
Clearing an event log evasion_event_log_clear	Clears the Windows Application event log, which is the anti-forensic step that follows a successful intrusion and raises event 1102. This cannot be un…	high
Disabling the host firewall evasion_firewall_disable	Turns the host firewall off and immediately back on, using the platform's own tool (netsh advfirewall, socketfilterfw, ufw or firewalld). The re-enabl…	high

the whole catalogue this test in the list run it yourself

Catalogue generated from client 0.1.0. A test's behaviour can change between releases; this page describes the version named here.