PowerShell Timestomping Using notepad.exe as Timestamp Reference
Detects the use of PowerShell to modify file timestamps by using the timestamps of the legitimate notepad.exe as a reference point. This technique is often used to make malicious files blend in with system files by adopting their creation, access, or write times.
Microsoft Sentinel (KQL)
