File Creation Date Changed to Another Year
This rule detects when a file's creation timestamp is changed to a different year than its previous creation timestamp. This technique, known as timestomping, can be used by attackers to make malicious files appear legitimate or to evade detection by blending them with existing system files. The rule specifically looks for changes where the year component of `PreviousCreationUtcTime` differs from `CreationUtcTime`. It includes filters to reduce false positives from common system processes like `ProvTool.exe`, `usocoreworker.exe`, `SystemSettings.exe`, and `TiWorker.exe` when handling temporary files or cabinet files.
Sigma
