Linux System Time Modification

A subject modifies the Linux system time, time zone, hardware clock, or time synchronization configuration to obscure the chronology of activity relevant to an insider threat investigation. This behavior may affect timestamps associated with file creation, file modification, authentication records, shell history, service execution, package activity, scheduled jobs, and other host-based artifacts used to reconstruct subject activity.

On Linux systems, this behavior may involve commands or utilities such as timedatectl, date, hwclock, or changes to time synchronization services such as NTP, Chrony, or systemd-timesyncd.