ITM is an open framework - Submit your contributions now.

Detections

ConsoleHost_history.txt Created Timestamp Discrepancy

ConsoleHost_history.txt File Missing

Windows File Deleted, Event Logs

Windows System Logging was Cleared

Print Spooler Service

Installed Printers via Registry

Printed Documents via Event Logs

Tamper Seal

Cyber Deception, File Canary

Cyber Deception, Honeypot

Cyber Deception, Honey User

Windows Operating System Installed Date

NTFS Timestamp Discrepancy

Utilize Cold Storage for Logs

Windows Local Account Deleted

Windows System Shutdown, Event Logs

Firefox Browser History

Edge Browser History

Chrome Browser History

Shellbags, USB Removable Storage

USBSTOR Registry Key

USB Registry Key

MountedDevices Registry Key

Windows Event Log, DriverFrameworks-UserMode

Windows Setupapi.dev.log

Windows LNK Files

Windows Prefetch

File Metadata

File EXIF Data

auditd Timestamp Modification Rule

Windows Thumbcache

Closed-Circuit Television

Terminal Service Client Registry Key

RDP Bitmap Cache

Windows Jump Lists

auditd File Access

Windows Recycle Bin

Web Proxy Logs

Microsoft Exchange Message Trace

Email Gateway

Network Intrusion Detection Systems

Sysmon Process Create Event

Linux dpkg Log

Agent Capable of User Activity Monitoring

Agent Capable of Endpoint Detection and Response

Agent Capable of User Behaviour Analytics

Data Loss Prevention Solution

Social Media Monitoring

Impossible Travel

DNS Logging

Audit Logging

Missing .bash_history File

.bash_history Timestamp Discrepency

PowerShell Logging

User Account Deleted, Windows Event Log

Chrome Browser Cookies

Chrome Browser Login Data

Chrome Browser Bookmarks

Chrome Browser Extensions

Notepad.exe TabState

Microsoft 365 Admin Center Sign-in Activity

Microsoft Entra ID Sign-in Logs

AWS CloudTrail, Resource Deletion

GCP Cloud Audit Logs, Resource Deletion

Azure Activity Log, Resource Deletion

Financial Auditing

Windows Event Log, Logon and Logoff

Security Software Anti-Tampering Alerts

Windows Event Log, Local Firewall Changes

Map Network Drive MRU

TypedPaths

Network Registry Key

Shellbags, Network Drives

USB MountPoints2

Bash History

AzureAD PowerShell Log

Clipboard Payloads via ActivitiesCache.db

MFT Entry Number Sequence Irregularities

MFT Unusual Timestamp Patterns

MFT and Shimcache Executable Timestamp Comparison

Microsoft Unified Audit Log

Windows Event Log, Software Uninstallation

DNS Monitoring

Deep Packet Inspection

NetFlow Analysis

Windows Event Log, Audit Removable Storage

Virtual Private Network (VPN) Logs

User Behavior Analytics (UBA)

User and Entity Behavior Analytics (UEBA)

Photographic Identification Comparison

Leaver Watchlist

vssadmin Shadow Copy Deletion

Microsoft Entra ID Privileged Identity Management Resource Audit

Microsoft Teams Admin Center Meeting and Call History

macOS File System Events (FSEvents) Store Database

Windows Event Log, System Time Modification

MIP Label Activity Monitoring

Cyber Deception, Honey SPN

Asset Discovery Audit

Tracking Patterns of Policy Violations

Baseline System Performance Profiling

AWS Unauthorized System or Service Modification

GCP Unauthorized System or Service Modification

Azure Unauthorized System or Service Modification

OCI Unauthorized System or Service Modification

SystemPropertiesRemote.exe Execution

Modification of RDP Registry Keys

RDP Group Membership Changes

DNS and HTTPS Traffic to Web-Based Remote Access Platforms

Access to /mnt/c/ from Within WSL

Installation of New WSL Distributions

Threat Intelligence Feeds for Insider Threat Indicators

Registry Value Audit, Start_TrackProgs

Absence of Expected Entries in RunMRU and UserAssist

Microsoft Purview eDiscovery

Snipping Tool Cached Screenshots

Snipping Tool TempState\Snips

Snipping Tool Cached Recordings

Snipping Tool TempState\Recordings

Snipping Tool Autosave Setting Modification

Python History File

OneDrive SafeDelete.db

Discrepancies Between Physical Access Logs and System Authentication

Modification of etc/hosts File

Microsoft Defender, Printed File

Microsoft Defender, Creation of Forwarding/Redirect Rule

Microsoft Defender, Granted Mailbox Permission

Microsoft Defender, Shared File Externally

Automated Visual and Thermal Baseline Scanning of Server Environments

Asset Register Correlation

Microsoft Exchange, Auto Forwarded Message Report

File Integrity Monitoring

ID: DT091
Created: 27th July 2024
Updated: 27th July 2024
Platform: Windows
Contributor: Joshua Phillips

MFT Entry Number Sequence Irregularities

MFT Entry Number Sequence Irregularities refer to inconsistencies where the sequential order of Master File Table (MFT) entries in an NTFS file system does not align with the chronological order of file timestamps. Such irregularities can indicate potential file manipulation or tampering, such as timestamping, where timestamps are altered to obscure the true timeline of file creation or modification.

Sections

ID	Name	Description
AF003	Timestomping	A subject modifies the modified, accessed, created (MAC) file time attributes to hide new files or obscure changes made to existing files to hinder an investigation by removing a file or files from a timeframe scope. nTimestomp is part of the nTimetools repository, and it provides tools for working with timestamps on files on the Windows operating system. This tool allows for a user to provide arguments for each timestamp, as well as the option to set all timestamps to the same value. Linux has the built-in command `touch` that has functionality that allows a user to update the access and modified dates of a file. The command can be run like this: `touch -a -m -d ‘10 February 2001 12:34' <file>` The argument `-a` refers to the access time, `-m` refers to the modify time, and `-d` refers to the date applied to the target file.