skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

hunting-for-defense-evasion-via-timestomping

Detect NTFS timestomping by comparing $STANDARD_INFORMATION and $FILE_NAME timestamps in parsed MFT data.

954|172|Updated Mar 13, 2026
Search Tags:#incident response#threat hunting#defense evasion#timestomping#mft analysis#t1070.006#ntfs forensics
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill hunting-for-defense-evasion-via-timestomping
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunting-for-defense-evasion-via-timestomping
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/threat-hunting/hunting-for-defense-evasion-via-timestomping
Command: npx skills add https://github.com/xalgord/xalgorix --skill hunting-for-defense-evasion-via-timestomping

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires pandas, mft.

What problem does it solve?

Adversaries manipulate NTFS file timestamps (MITRE ATT&CK T1070.006) to blend malware into legitimate directories and evade detection. This Skill identifies timestomping by comparing $STANDARD_INFORMATION timestamps (easily modified by user-mode tools) against $FILE_NAME timestamps (updated only by the NTFS kernel driver) in parsed Master File Table data.

Core Features & Use Cases

  • SI vs FN Timestamp Comparison: Parses MFTECmd CSV output with pandas and flags files where $STANDARD_INFORMATION timestamps predate $FILE_NAME timestamps, a strong timestomping indicator.
  • Multi-Heuristic Detection: Checks for zeroed nanoseconds, impossible temporal orderings, and multi-year gaps between SI and FN attributes with confidence scoring.
  • Corroboration Pipeline: Cross-references findings with USN Journal BASIC_INFO_CHANGE events and ShimCache/Amcache timestamps to validate detections and reduce false positives.
  • Use Case: During incident response on a compromised Windows host, extract the $MFT with KAPE, parse it with MFTECmd, and run the detection workflow to surface files whose timestamps were altered by tools like Timestomp, NTimeStomp, or SetMACE, then export a structured JSON report for the SOC team.

Quick Start

Ask the AI to analyze a parsed MFTECmd CSV export for timestomping indicators by comparing $STANDARD_INFORMATION and $FILE_NAME timestamps and generate a detection report.

Frequently Asked Questions about hunting-for-defense-evasion-via-timestomping

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect timestomping in NTFS file systems?▼

Detect timestomping by comparing $STANDARD_INFORMATION (0x10) and $FILE_NAME (0x30) timestamps in parsed MFT data. When SI timestamps are older than FN timestamps, user-mode tools likely altered them, since FN timestamps are only updated by the NTFS kernel driver.

How to parse the Windows $MFT file for forensic analysis?▼

Parse the $MFT using Eric Zimmerman's MFTECmd with the -f flag and --csv output option, which produces a CSV containing both 0x10 and 0x30 timestamp columns. Alternatively, use analyzeMFT or the Python mft library for programmatic parsing.

What tools extract the $MFT from a live Windows system?▼

KAPE with the !SANS_Triage target, FTK Imager CLI, or RawCopy can extract the locked $MFT from a live system. On mounted forensic images in Linux, use sleuthkit's icat command to carve the MFT.

Can timestomping detection produce false positives?▼

Yes. Installers, robocopy /COPY:DAT, 7-Zip extraction, and backup software legitimately copy or reset timestamps, triggering the nanosecond-zeroed heuristic. Establish a known-clean baseline image and corroborate with USN Journal and ShimCache before alerting.

What are the limitations of SI vs FN timestamp comparison?▼

Advanced tools like SetMACE or raw-disk manipulation can align both $STANDARD_INFORMATION and $FILE_NAME timestamps, defeating the comparison. Always corroborate with USN Journal BASIC_INFO_CHANGE events, $LogFile analysis, and ShimCache/Amcache records.

Related Skills

Explore More Software Engineering Skills→
YukiIto1999YukiIto1999

performing-endpoint-forensics-investigation

Identify and document endpoint compromises through Windows digital forensics investigations.

Community
Advanced
UnitOneAIUnitOneAI
44

containment

Generate NIST SP 800-61 Rev 2-aligned containment plans with MITRE ATT&CK-mapped countermeasures.

Official
Intermediate
AxxxxxxaaannAxxxxxxaaann

analyzing-mft-for-deleted-file-recovery

Parse NTFS MFT records to recover deleted file metadata and timelines.

Community
Advanced
team-telnyxteam-telnyx
3

telnyx-webrtc-client-react-native

Integrate Telnyx Voice SDK for cross-platform VoIP apps in React Native with iOS and Android support.

Official
Intermediate