Mirrors/keyboardcrunch-sentinelone-queries
1
0
Fork 0
mirror of https://github.com/keyboardcrunch/sentinelone-queries synced 2026-06-08 17:07:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

powershell timestomp detection

Browse Source
This commit is contained in:
@
2020-11-24 12:57:03 -06:00
parent a428941d64
commit e4aae04765
1 changed files with 17 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
queries/windows/powershell_time_stomping.yml
+17
View File
@@ -0,0 +1,17 @@
title: PowerShell TimeStomping
description: Detection of time stomping with PowerShell.
author: keyboardcrunch
date: 24/11/2020
modified:
mitre:
tactic: Defense Evasion
technique: T1070
subtechnique: 006
operating_system: windows
query: SrcProcCmdScript In Contains Anycase ("[IO.File]::SetCreationTime","[IO.File]::SetLastAccessTime","[IO.File]::SetLastWriteTime")
false_positives:
-
tags:
-
references:
- https://attack.mitre.org/techniques/T1070/006/