Revisiting TTPs: TimeStomper
ID: 71c0186e-a08d-54ad-828d-02bf2c1aa043
STIX ID: report--71c0186e-a08d-54ad-828d-02bf2c1aa043
Feed Name: SpecterOps Blog
The report explains Windows timestomping and introduces a PoC tool, TimeStomper, to set, randomize, or copy file and folder timestamps (including recursive operation), detailing how it leverages Windows APIs and highlighting NTFS artifact caveats. It demonstrates detection using PowerForensics (MFT inspection) and Sysmon event ID 2 with a tuned configuration, and notes limitations versus Metasploit’s more complete modification of $STANDARD_INFORMATION.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.