executing-plans
executing-plans
Use when executing an implementation plan in the current session as the implementer yourself — your human partner chose inline execution, or no subagent tool is available
Explore skills
Productivity · SKILL.md
hunting-for-defense-evasion-via-timestomping
hunting-for-defense-evasion-via-timestompingDetect NTFS timestamp manipulation (MITRE T1070.006) by comparing $STANDARD_INFORMATION vs $FILE_NAME timestamps in the MFT. Uses analyzeMFT and Python to identify files with anomalous temporal patterns indicating anti-forensic timestomping activity.
Independent GitHub snapshot · Automated classification · Original documentation governs
Skill documentation
GitHubname: hunting-for-defense-evasion-via-timestomping description: > Detect NTFS timestamp manipulation (MITRE T1070.006) by comparing $STANDARD_INFORMATION vs $FILE_NAME timestamps in the MFT. Uses analyzeMFT and Python to identify files with anomalous temporal patterns indicating anti-forensic timestomping activity. domain: cybersecurity subdomain: threat-hunting tags: [timestomping, ntfs-forensics, mft-analysis, defense-evasion] version: "1.0" author: mahipal license: Apache-2.0
Hunting for Defense Evasion via Timestomping
Detect timestamp manipulation by analyzing NTFS MFT entries for discrepancies between $STANDARD_INFORMATION and $FILE_NAME attributes.