hunting-for-defense-evasion-via-timestomping

name	hunting-for-defense-evasion-via-timestomping
description	Detect NTFS timestamp manipulation (MITRE T1070.006) by comparing $STANDARD_INFORMATION vs $FILE_NAME timestamps in the MFT. Uses analyzeMFT and Python to identify files with anomalous temporal patterns indicating anti-forensic timestomping activity. . Use when working with hunting for defense evasion via timestomping.
domain	cybersecurity
tags	["timestomping","ntfs-forensics","mft-analysis","defense-evasion"]
subdomain	threat-hunting
version	1.0
author	oyi77
license	Apache-2.0
d3fend_techniques	["File Metadata Consistency Validation","Content Format Conversion","File Content Analysis","Platform Hardening","File Format Verification"]
nist_csf	["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"]

Hunting For Defense Evasion Via Timestomping

Overview

Cybersecurity skill for hunting for defense evasion via timestomping. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "hunting for defense evasion via timestomping"

• "Detect NTFS timestamp manipulation (MITRE T1070"

• Investigating suspected anti-forensic activity where an adversary may have altered file timestamps to blend malware into legitimate directories

• Threat hunting for defense evasion (MITRE ATT&CK T1070.006) across compromised Windows systems

• Validating timeline integrity during forensic examinations of disk images or live acquisitions

• Triaging suspicious files that appear to have creation dates older than the OS installation or inconsistent with known deployment timelines

• Detecting tools like Timestomp (Metasploit), NTimeStomp, SetMACE, or PowerShell Set-ItemProperty used to alter timestamps

• Building automated detection pipelines that flag temporal anomalies in MFT data for SOC analysts

Do not use as the sole detection method; advanced adversaries can manipulate both $STANDARD_INFORMATION and $FILE_NAME timestamps (though the latter requires raw disk access and is much harder). Combine with USN Journal, $LogFile, and ShimCache/Amcache analysis for corroboration.

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Raw $MFT file extracted from a Windows system (via FTK Imager, KAPE, or live extraction)
• MFTECmd (Eric Zimmerman tool) or analyzeMFT for MFT parsing
• Python 3.8+ with pandas for analysis
• Optional: mft Python library (pip install mft) for programmatic MFT parsing
• Optional: KAPE (Kroll Artifact Parser and Extractor) for automated artifact collection
• Timeline Explorer or Excel for visual analysis of parsed MFT output

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    : ,
    : ,
    : ,
}

 () -> :
     {k: re.findall(v, text)  k, v  IOC_PATTERNS.items()}