Timestomping via PowerShell Timestamp Manipulation or Known Webshell File Creation

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects potential timestomping activities via PowerShell APIs or touch.exe usage, alongside the creation or modification of known webshell filenames in web directories or files placed in common web root subdirectories by web server processes.