Timestomping of Webshell Files in IIS Web Directories via PS/rundll32/Timestomp

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects the creation of a suspicious file (script or executable) within common web directories (inetpub or wwwroot) followed by an attempt to timestomp that file using common tools like PowerShell, Rundll32, or dedicated timestomping binaries within a 30-minute window. This behavior is indicative of an attacker attempting to establish persistence via a web shell while concealing the activity by modifying file timestamps.