Sigma rule: File Creation Date Changed to Another Year

Rule

Title

File Creation Date Changed to Another Year

Status

test

Level

low

Author

frack113, Florian Roth (Nextron Systems)

Date

2022-08-12

Modified

2026-01-20

File

rules-threat-hunting/windows/file/file_change/file_change_win_date_changed_to_another_year.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects when the file creation time is changed to a year before 2020.
Attackers may change the file creation time of a backdoor to make it look like it was installed with the operating system.
Note that many processes legitimately change the creation time of a file; it does not necessarily indicate malicious activity.
In order to use this rule in production, it is recommended first baseline normal behavior in your environment and then tune the rule accordingly.
Hunting Recommendation: Focus on files with creation times set to years significantly before the current date, especially those in user-writable directories.
Correlate with process execution logs to identify the source of the modification and investigate any unsigned or suspicious binaries involved.

Log source

product

windows

category

file_change

Detection

selection:
    PreviousCreationUtcTime|startswith: '202'
filter_main_creation_time:
    CreationUtcTime|startswith: '202'
filter_main_program_files:
    - TargetFilename|startswith:
          - 'C:\Program Files\'
          - 'C:\Program Files (x86)\'
    - Image|startswith:
          - 'C:\Program Files\'
          - 'C:\Program Files (x86)\'
filter_optional_updates:
    - Image:
          - 'C:\Windows\system32\ProvTool.exe'
          - 'C:\Windows\System32\usocoreworker.exe'
          - 'C:\Windows\ImmersiveControlPanel\SystemSettings.exe'
    - TargetFilename|startswith: 'C:\ProgramData\USOPrivate\UpdateStore\'
    - TargetFilename|endswith:
          - '.tmp'
          - '.temp'
filter_optional_cab:
    Image|startswith: 'C:\WINDOWS\System32\'
    Image|endswith:
        - '\TiWorker.exe'
        - '\svchost.exe'
        - '\sihclient.exe'
    TargetFilename|endswith: '.cab'
filter_optional_msiexec:
    Image: 'C:\Windows\system32\msiexec.exe'
filter_optional_vcredist:
    Image|startswith: 'C:\Windows\Temp\'
    Image|endswith: '\VCREDI~1.EXE'
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*

False positives (as the rule lists them)

• Changes made to or by the local NTP service
• Software installations and updates

Tags

• attack.stealth
• attack.t1070.006
• detection.threat-hunting

MITRE ATT&CK ids this rule names

• T1070.006

References

• https://www.inversecos.com/2022/04/defence-evasion-technique-timestomping.html

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-threat-hunting/windows/file/file_change/file_change_win_date_changed_to_another_year.yml