Linux Timestomping via 'touch -r' or '--reference'

Danny Y@zendannyy

•updated Apr 26, 2026•7•0•112

Detects attempts to modify file timestamps on Linux systems using the 'touch' command with the '-r' or '--reference' flags. This technique, known as timestomping, allows adversaries to change the access and modification times of a file to match those of another file, to evade detection or blend malicious files with legitimate ones.