Timestomp
Subtechnique · ATTACK:enterprise:T1070.006
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1070.006",
"title": "Timestomp",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1070/006",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--47f2d673-ca62-47e9-929b-1b0be9657611",
"external_id": "T1070.006",
"domain": "enterprise",
"created": "2020-01-31T12:42:44.103Z",
"modified": "2026-05-12T15:12:00.630Z",
"version": "2.0",
"aliases": [
],
"tactics": [
"stealth"
],
"source_references": [
{
"source_name": "Juniper Networks ESXi Backdoor 2022",
"url": "https://blogs.juniper.net/en-us/threat-research/a-custom-python-backdoor-for-vmware-esxi-servers"
},
{
"source_name": "WindowsIR Anti-Forensic Techniques",
"url": "http://windowsir.blogspot.com/2013/07/howto-determinedetect-use-of-anti.html"
},
{
"source_name": "Inversecos Linux Timestomping",
"url": "https://www.inversecos.com/2022/08/detecting-linux-anti-forensics.html"
},
{
"source_name": "Inversecos Timestomping 2022",
"url": "https://www.inversecos.com/2022/04/defence-evasion-technique-timestomping.html"
},
{
"source_name": "Magnet Forensics",
"url": "https://www.magnetforensics.com/blog/expose-evidence-of-timestomping-with-the-ntfs-timestamp-mismatch-artifact-in-magnet-axiom-4-4/"
},
{
"source_name": "Double Timestomping",
"url": "https://x.com/matthewdunwoody/status/1519846657646604289"
}
]
}Explicit source assertions (60)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:T1070.006 → subtechnique-of → ATTACK:enterprise:T1070
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0d06a9f1-fc35-4f35-a628-3515b0686747
ATTACK:enterprise:S0586 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0d4d42e9-0473-42fc-b018-c79b54c7a87f
CISA MAR-10288834-2.v1 TAINTEDSCRIBE MAY 2020ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1036833a-1d4c-4d9e-b716-1e52606ab684
Crowdstrike DNC June 2016ATTACK:enterprise:S0687 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--10b32db9-57a8-4baa-b540-3d26f9c7137b
NCSC Cyclops Blink February 2022ATTACK:enterprise:G1023 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--172391d2-7207-42b0-987b-8760bc58e35a
Mandiant Pulse Secure Update May 2021ATTACK:enterprise:S0168 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1dfbe8fe-0e7a-42a7-85f0-a94b086b470b
ESET Gazer Aug 2017ATTACK:enterprise:C0064 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--21a084fb-f7a1-497f-913a-27c5db86233b
AI-Mexico-Govt-BreachATTACK:enterprise:S0603 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--237283ca-5cae-48c3-9a5a-3dc17725cd5f
Nicolas Falliere, Liam O Murchu, Eric Chien February 2011ATTACK:enterprise:S0239 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--26352538-769c-42c0-9e38-0338c5891432
McAfee BankshotATTACK:enterprise:S0181 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3017cf15-f6a8-4281-8c74-9dd8f7c2666f
US-CERT FALLCHILL Nov 2017ATTACK:enterprise:S1181 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--31937015-5f2e-4436-80b0-77043d620f79
Microsoft BlackByte 2023ATTACK:enterprise:S0072 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--37804b22-63b4-4b24-846e-6541688d9213
Dell TG-3390ATTACK:enterprise:C0029 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4b688df5-5ecf-48ea-a15f-4509e557224c
Mandiant Cutting Edge Part 3 February 2024 · Mandiant Cutting Edge Part 2 January 2024ATTACK:enterprise:S1090 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--51eb8d9b-1ca4-4a9e-9df4-9415e54e8aff
MoustachedBouncer ESET August 2023ATTACK:enterprise:S0136 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--553dbb57-1174-494c-9cfd-dbc83ecc74f6
ESET Sednit USBStealer 2014ATTACK:enterprise:S0570 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5793708d-b25a-4276-9b0b-697a8494e0f8
Crowdstrike Indrik November 2018ATTACK:enterprise:S0021 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--60137eb6-ed8c-41ce-bf75-6b45cdafe751
Fidelis Turbo · Novetta-AxiomATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--61e9d783-571b-49d4-a30b-8fde8a13d4c0
cobaltstrike manual · Cobalt Strike Manual 4.3 November 2020ATTACK:enterprise:S0352 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--630ef5c5-438d-4681-b4e9-b9dee3934848
Trend Micro MacOS Backdoor November 2020 · 20 macOS Common Tools and TechniquesATTACK:enterprise:S0393 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--63dc6102-8405-4273-8e73-7df7ef6c2514
ESET Turla PowerShell May 2019ATTACK:enterprise:S0185 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6d562520-86bb-4251-9431-a4958bec097c
FireEye APT34 Webinar Dec 2017ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6dde5532-a13a-4b47-b063-1a95ad25820b
Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023ATTACK:enterprise:S0081 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6deeb486-90c3-4279-8549-17c81ea2466b
Lotus Blossom Jun 2015ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6fa3a8bd-3a66-4f48-9439-97e5ae3dcac9
CISA AA20-239A BeagleBoyz August 2020ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--71a8ae5e-3a78-49b5-9857-e202d636cedf
FireEye APT32 May 2017 · ESET OceanLotus Mar 2019 · ESET OceanLotus macOS April 2019ATTACK:enterprise:S9023 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7b579813-3338-4f86-bba5-40a9a971fb33
ESET HiddenFace 2024 · JPCERT MirrorFace JUL 2024 · Trend Micro Earth Kasha NOV 2024ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7bc61687-f105-403f-b83f-91168c8f41ad
Cybereason Kimsuky November 2020ATTACK:enterprise:S0387 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8343b346-e529-4f28-a569-ae5f9a862ddf
PWC KeyBoys Feb 2017ATTACK:enterprise:S0568 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8f8618b7-f197-4869-bb35-3ca58d171be0
Prevailion EvilNum May 2020ATTACK:enterprise:S0520 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--914526ae-3322-440f-b79e-780bb0c84cf5
US-CERT BLINDINGCAN Aug 2020 · NHS UK BLINDINGCAN Aug 2020ATTACK:enterprise:S1016 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--95ac6b41-2594-48a0-8437-c7d93111ed66
ESET DazzleSpy Jan 2022ATTACK:enterprise:S1161 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--99fe6bfd-6199-4a9d-a18b-49c6f7be4074
Sandfly BPFDoor 2022ATTACK:enterprise:S0641 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9bbfc21c-17ab-4f9a-bd8c-5079ee9b180f
ESET Kobalos Jan 2021ATTACK:enterprise:S1031 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9d8296bb-40a0-4a08-a01a-f6dd4409c6f1
Unit 42 PingPull Jun 2022ATTACK:enterprise:G0016 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a1da2d38-1c36-46bb-9245-ec4f650ef101
Mandiant APT29 Eye Spy Email Nov 22ATTACK:enterprise:S0438 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a2db7220-d784-485f-bc77-046b90c02daf
ESET Attor Oct 2019ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a4a0c78e-6f15-4304-9e40-36c09a532a05
Microsoft Deep Dive Solorigate January 2021ATTACK:enterprise:S0020 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a6350331-0c0d-4d0d-90a3-d5cc3e420875
FireEye Periscope March 2018 · Lee 2013 · NCSC Joint Report Public ToolsATTACK:enterprise:S1164 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ae29058c-c1ff-43a3-bc72-cc7570f8ff46
Volexity UPSTYLE 2024ATTACK:enterprise:S0260 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b039a79c-8df3-4e89-95ad-03d27b16a13c
ESET InvisiMole June 2018ATTACK:enterprise:S0666 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bf3726ed-c160-4f94-9b48-65a7da2a4ed3
ESET Gelsemium June 2021ATTACK:enterprise:S0141 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bf833c53-a60f-4e92-92b4-9987334e7f85
Novetta Winnti April 2015ATTACK:enterprise:C0032 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cbcb2ce0-29b6-47ba-9dc0-2154a31ca3a1
FireEye TRITON 2019ATTACK:enterprise:G0114 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d275fe0c-3769-4fb1-80ee-2f8477019123
NCC Group Chimera January 2021ATTACK:enterprise:S0164 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d2fa2382-dcfc-4cff-969b-2b5ec12dc406
ClearSky Wilted Tulip July 2017ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d35f6c6f-c1ed-4b0d-b95f-9fd762eb3ac7
Novetta Blockbuster Destructive Malware · Novetta Blockbuster Loaders · Novetta Blockbuster · McAfee GhostSecretATTACK:enterprise:S0066 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d43315b0-d708-4197-b3ed-0a0b1199e434
CrowdStrike Putter PandaATTACK:enterprise:S0150 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d57d1a71-6ac7-4028-ba73-86e5df98395f
FireEye POSHSPY April 2017ATTACK:enterprise:S0078 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d8a7ec97-b262-489d-bc4b-e2c7007f75bc
Scarlet Mimic Jan 2016ATTACK:enterprise:S1135 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d8ea50e5-0e68-4253-a922-61b549c40778
Unit42 Agrius 2023ATTACK:enterprise:S1149 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d92cf7e9-db9f-486c-a8e6-6018ad3d3959
Mandiant ROADSWEEP August 2022ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dc6b1914-e366-45c8-b2f5-c83dbd9cd242
Palo Alto Networks, Unit 42ATTACK:enterprise:S1100 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dce1aedd-ea3f-4301-b44b-dae14d411697
Kaspersky ToddyCat June 2022ATTACK:enterprise:S1226 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e7133f0c-0e76-4a10-8aa4-05a38fc1fbf7
Palo Alto Networks, Unit 42ATTACK:enterprise:S0083 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ea964313-8f60-4cff-800c-2ea49e2c19d7
Cylance Dust StormATTACK:enterprise:S0140 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ebf68107-a2b8-4ff1-916f-e1861a20914a
McAfee Shamoon December 2018ATTACK:enterprise:S1059 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ecbe0204-b205-47d5-ba6a-ef5c29737eda
SentinelLabs Metador Technical Appendix Sept 2022ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f082a4e1-b454-4528-9470-a2799215b235
Github PowerShell EmpireATTACK:enterprise:S9024 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f1e4c1ce-98d7-43fd-af33-f26f73aeca8b
CISA SPAWNCHIMERA RESURGE February 2026ATTACK:enterprise:G0106 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ff14431c-bf82-44be-b12a-a65e88d5347a
Anomali Rocke March 2019