计划执行与检查节点
executing-plans
按既定实施计划完成工作，保持过程检查和反馈。
探索技能
效率与协作 · SKILL.md
hunting-for-defense-evasion-via-timestomping
hunting-for-defense-evasion-via-timestomping【效率与协作】Detect NTFS timestamp manipulation (MITRE T1070.006) by comparing $STANDARD_INFORMATION vs $FILE_NAME timestamps in the MFT. Uses analyzeMFT and Python to identify files with anomalous temporal patterns indicating anti-forensic timestomping activity.
独立 GitHub 快照 · 自动分类 · 以原作者文档为准
技能说明
GitHubname: hunting-for-defense-evasion-via-timestomping description: > Detect NTFS timestamp manipulation (MITRE T1070.006) by comparing $STANDARD_INFORMATION vs $FILE_NAME timestamps in the MFT. Uses analyzeMFT and Python to identify files with anomalous temporal patterns indicating anti-forensic timestomping activity. domain: cybersecurity subdomain: threat-hunting tags: [timestomping, ntfs-forensics, mft-analysis, defense-evasion] version: "1.0" author: mahipal license: Apache-2.0
Hunting for Defense Evasion via Timestomping
Detect timestamp manipulation by analyzing NTFS MFT entries for discrepancies between $STANDARD_INFORMATION and $FILE_NAME attributes.