Timestomping via PowerShell LastWriteTime or touch -t Targeting Web Directories

Ibrahim Saud@tektrix

•updated Jun 30, 2026•2•0•2

Detects attempts to modify file timestamps (CreationTime, LastWriteTime, LastAccessTime) using PowerShell Set-ItemProperty cmdlets or command-line tools like 'touch'. This behavior is often associated with adversary attempts to hide artifacts or modify forensic timelines, specifically when targeting directories associated with web servers.