Timestomping Detection
This rule detects potential timestomping activity by identifying files where the creation time is later than the modification time. This behavior can indicate an adversary attempting to manipulate file timestamps to evade detection or forensic analysis. The rule specifically targets executable and script file extensions.
Cortex XDR
