Claude
Skills
Sign in
Back

hunting-for-defense-evasion-via-timestomping

Included with Lifetime
$97 forever

Detect NTFS timestamp manipulation (MITRE T1070.006) by comparing $STANDARD_INFORMATION vs $FILE_NAME timestamps in the MFT. Uses analyzeMFT and Python to identify files with anomalous temporal patterns indicating anti-forensic timestomping activity.

Generaltimestompingntfs-forensicsmft-analysisdefense-evasionscripts

What this skill does


# Hunting for Defense Evasion via Timestomping

Detect timestamp manipulation by analyzing NTFS MFT entries for
discrepancies between $STANDARD_INFORMATION and $FILE_NAME attributes.

Related in General