Hunting For Defense Evasion Via Timestomping

Detect NTFS timestamp manipulation (MITRE T1070.006) by comparing $STANDARD_INFORMATION vs $FILE_NAME timestamps in the MFT. Uses analyzeMFT and Python to identify files with anomalous temporal patterns indicating anti-forensic timestomping activity.

autohandai Updated

File contents

Hunting for Defense Evasion via Timestomping

Detect timestamp manipulation by analyzing NTFS MFT entries for discrepancies between $STANDARD_INFORMATION and $FILE_NAME attributes.

autohandai/community-skills/tree/main/hunting-for-defense-evasion-via-timestomping commit 61ed63ed3c

Frequently asked questions

npx skillmds@latest add autohandai-community-skills/hunting-for-defense-evasion-via-timestomping