Timestomping of ASPX Webshell Files via PowerShell Timestamp Manipulation

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•5

Detects the use of PowerShell to manually modify file system timestamps (CreationTime, LastWriteTime, LastAccessTime) on ASPX files or within common web-accessible directories. This technique is often used by adversaries to hide the true creation or modification time of webshells, facilitating anti-forensic activities and timeline corruption.