win:sysmon 2
A process changed a file creation time
The change file creation time event is registered when a file creation time is explicitly modified by a process.
- Log source
- Sysmon
- Host type
- Windows (workstation, member server, domain controller)
- How to enable
- Install Sysmon with a configuration that includes the matching rule group; see sysmon-modular for an ATT&CK-mapped configuration.
- Tier, host type
- Recommended
- Techniques
- 12
- Rules depending on it
- Sigma 2, Elastic 1
Why this tier
By role
| Role | Tier | Basis |
|---|---|---|
| Windows workstation | Recommended | |
| Windows member server | Recommended | |
| Windows domain controller | Recommended | |
| Windows web server (IIS), internet-facing | Recommended |
Techniques it helps detect
- T1003.002 Security Account Manager
- T1003.003 NTDS
- T1053 Scheduled Task/Job
- T1137.006 Add-ins
- T1486 Data Encrypted for Impact
- T1491.001 Internal Defacement
- T1539 Steal Web Session Cookie
- T1546.013 PowerShell Profile
- T1547.008 LSASS Driver
- T1547.009 Shortcut Modification
- T1554 Compromise Host Software Binary
- T1565 Data Manipulation
Rules that depend on it
Sigma 2
- File Creation Date Changed to Another Year by frack113, Florian Roth (Nextron Systems)
- Unusual File Modification by dns.exe by Tim Rauch (Nextron Systems), Elastic (idea)