cyber-hunting-for-defense-evasion-via-timestomping

name	cyber-hunting-for-defense-evasion-via-timestomping
description	Detect NTFS timestamp manipulation (MITRE T1070.006) by comparing $STANDARD_INFORMATION vs $FILE_NAME timestamps in the MFT. Uses analyzeMFT and Python to identify files with anomalous temporal patterns indicating anti-forensic timestomping activity.
hide	true

YURI skill adapter

Authoritative source: .claude/skills/cyber-hunting-for-defense-evasion-via-timestomping/SKILL.md

Authoritative source SHA-256: cbc01d77ae99fa8600def00d8e198b9896ffa64bcd8bcb5b8b6a6226cd66e2e3

Source class: cyber-armed

Before acting, read the authoritative source file above completely from beginning to end. If the governed source is absent, run node _SYSTEM/Scripts/skill-recall.mjs --show cyber-hunting-for-defense-evasion-via-timestomping and read its complete verified output. Follow that source as the skill body; this adapter is a non-authoritative metadata-and-pointer projection.