Detecting Timestomping: Sysmon Event 2 and MFT Mismatches

Attackers alter file timestamps so a dropped binary appears to have been on the system for years, blending into the timeline. Most tools change only the $STANDARD_INFORMATION attribute, which user-mode APIs can write. The $FILE_NAME attribute is updated by the NTFS driver, so comparing the two, and checking precision, exposes the edit on disk long after the fact.

Signals at a Glance

Live Telemetry with Sysmon Event 2

Sysmon Event ID 2 logs a change to a file creation time, including the previous and new values and the process responsible. It is high volume if unfiltered, because browsers and installers legitimately set creation times, so use an exclude list tuned to your estate rather than an include list:

<!-- Sysmon configuration fragment: FileCreateTime with noise exclusions -->
<Sysmon schemaversion="4.90">
  <EventFiltering>
    <RuleGroup name="timestomp" groupRelation="or">
      <FileCreateTime onmatch="exclude">
        <!-- tune/validate: reviewed benign writers only -->
        <Image condition="end with">\chrome.exe</Image>
        <Image condition="end with">\msedge.exe</Image>
        <Image condition="is">C:\Windows\System32\msiexec.exe</Image>
        <Image condition="end with">\OneDrive.exe</Image>
      </FileCreateTime>
    </RuleGroup>
  </EventFiltering>
</Sysmon>

Review the remaining events by path. A creation time rewritten on an executable in a user profile, from a process that is not an installer or sync client, is the shape to escalate.

Offline MFT Comparison

The NTFS Master File Table holds two creation times per file, one in each attribute. A genuine file has $FILE_NAME no earlier than $STANDARD_INFORMATION in the common case; a file whose $STANDARD_INFORMATION predates its $FILE_NAME was probably back-dated. Parse the MFT with MFTECmd and filter on its built-in flags:

# Parse the MFT, then filter the CSV for timestomping indicators
MFTECmd.exe -f "C:\Evidence\$MFT" --csv "C:\Out" --csvf mft.csv

Import-Csv C:\Out\mft.csv |
  Where-Object { $_.'SI<FN' -eq 'True' -or $_.uSecZeros -eq 'True' } |
  Where-Object { $_.Extension -in '.exe','.dll','.sys','.ps1' } |
  Select-Object ParentPath, FileName, Created0x10, Created0x30, LastModified0x10 |
  Sort-Object ParentPath
# tune/validate: confirm column names for your MFTECmd version; expect noise from
# archive extraction and installers, so focus on user-writable paths.

• Correlate suspects with the USN journal, which records change reasons independently of the file timestamps the attacker edited.
• Weight findings by path: a back-dated DLL in System32 matters less than one in a user profile or ProgramData.
• Zeroed sub-second precision is a tool artifact, but some legitimate software also produces it; use it to rank, not to convict.
• Remember that sophisticated tools can set $FILE_NAME as well by moving or copying the file; rely on multiple sources.