Results for “ntm”

1 skill

Hunting For Defense Evasion Via Timestomping

Detect NTFS timestamp manipulation (MITRE T1070.006) by comparing $STANDARD_INFORMATION vs $FILE_NAME timestamps in the MFT using analyzeMFT and Python.

24.6k · bundle