Potential Timestomping via Touch Utility

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects potential timestomping activity that uses a system binary or library path as the reference file, which is a common timestomping technique on Linux. Attackers copy timestamps from a trusted system binary onto a malicious file to make it blend in with legitimate files and evade detection based on creation or modification time.

2026-10-12 00:00:00

None

3435dfe9-eb4c-42fc-b409-f62d2cab7fb3

attack.stealth attack.t1070.006

Nextron Sigma feed only (private)