mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-09-04 23:40:51 +03:00
20 lines
684 B
Markdown
20 lines
684 B
Markdown
---
|
|
name: hunting-for-defense-evasion-via-timestomping
|
|
description: >
|
|
Detect NTFS timestamp manipulation (MITRE T1070.006) by comparing
|
|
$STANDARD_INFORMATION vs $FILE_NAME timestamps in the MFT. Uses
|
|
analyzeMFT and Python to identify files with anomalous temporal
|
|
patterns indicating anti-forensic timestomping activity.
|
|
domain: cybersecurity
|
|
subdomain: threat-hunting
|
|
tags: [timestomping, ntfs-forensics, mft-analysis, defense-evasion]
|
|
version: "1.0"
|
|
author: mahipal
|
|
license: Apache-2.0
|
|
---
|
|
|
|
# Hunting for Defense Evasion via Timestomping
|
|
|
|
Detect timestamp manipulation by analyzing NTFS MFT entries for
|
|
discrepancies between $STANDARD_INFORMATION and $FILE_NAME attributes.
|