macOS File Time Attribute Change via Touch Command
This rule detects attempts to modify file time attributes using the 'touch' command on macOS. Adversaries may alter file timestamps to hide new or modified files, making them appear less suspicious to forensic investigators or automated tools. The rule specifically looks for the execution of the 'touch' command with common arguments used for timestomping, such as '-t' (specify time), '-acmr' (change access, modification, creation, and reference times), '-d' (specify date string), or '-r' (reference file).
Sigma
