Red Lamassu JFMBackdoor Timestomping — $SI Creation Time >30d Before Write (T1070.006)
Detects instances where the creation timestamp of a file is reported as being significantly older (more than 30 days) than the actual file creation event time, as recorded by Sysmon Event ID 2. This is a common indicator of timestomping, where attackers modify file creation metadata to evade detection or blend in with legitimate system files.
Splunk (SPL)
