{"id":"88c0f9d8-30a8-4120-bb6b-ebb54abcf2a0","title":"File Time Attribute Change","description":"Detect file time attribute change to hide new or changes to existing files","author":"Igor Fits, Mikhail Larin, oscd.community","status":"test","level":"medium","date":"2020-10-19","modified":"2022-01-12","tags":["attack.stealth","attack.t1070.006"],"technique_ids":["T1070.006"],"logsource":{"product":"macos","category":"process_creation"},"falsepositives":["Unknown"],"references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.006/T1070.006.md"],"source_path":"rules/macos/process_creation/proc_creation_macos_change_file_time_attr.yml","source_sha256":"f2535b8e042276376b7f69b2f05fa1d9d76820c715fb1fdbfe3b2f22daba94b2","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/macos/process_creation/proc_creation_macos_change_file_time_attr.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: File Time Attribute Change\nid: 88c0f9d8-30a8-4120-bb6b-ebb54abcf2a0\nstatus: test\ndescription: Detect file time attribute change to hide new or changes to existing files\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.006/T1070.006.md\nauthor: Igor Fits, Mikhail Larin, oscd.community\ndate: 2020-10-19\nmodified: 2022-01-12\ntags:\n    - attack.stealth\n    - attack.t1070.006\nlogsource:\n    product: macos\n    category: process_creation\ndetection:\n    selection:\n        Image|endswith: '/touch'\n        CommandLine|contains:\n            - '-t'\n            - '-acmr'\n            - '-d'\n            - '-r'\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1070.006","id":"T1070.006","name":"Timestomp","page":"techniques/enterprise/T1070.006/"}],"data_path":"data/detection-rules/88c0f9d8-30a8-4120-bb6b-ebb54abcf2a0.json","kind":"sigma"}