Enforce File Permissions

A subject modifies the modified, accessed, created (MAC) file time attributes to hide new files or obscure changes made to existing files to hinder an investigation by removing a file or files from a timeframe scope.

nTimestomp is part of the nTimetools repository, and it provides tools for working with timestamps on files on the Windows operating system. This tool allows for a user to provide arguments for each timestamp, as well as the option to set all timestamps to the same value.

Linux has the built-in command touch that has functionality that allows a user to update the access and modified dates of a file. The command can be run like this:

touch -a -m -d ‘10 February 2001 12:34' <file>

The argument -a refers to the access time, -m refers to the modify time, and -d refers to the date applied to the target file.

A subject collects, copies, retrieves, exports, records, or stages credentials, secrets, keys, certificates, tokens, or other authentication material in preparation for later access or misuse. This behavior may involve credentials assigned to the subject, credentials assigned to another individual, shared credentials, service account credentials, or authentication material discovered in exposed locations such as tickets, repositories, documentation, configuration files, scripts, password managers, or secrets vaults.

Credential collection becomes a preparatory concern when the subject’s handling of authentication material exceeds their legitimate operational need or indicates future use outside approved access processes. The behavior may include saving credentials to local files, screenshots, notes, spreadsheets, personal password managers, clipboard history, removable media, or other locations where they can be reused later.

This preparation may precede unauthorized access, internal credential sharing, privilege misuse, data collection, sabotage, or anti-forensic measures to mislead attribution.

The subject inserts, deletes, alters, substitutes, suppresses, or misrepresents organizational data in a manner that compromises its accuracy, completeness, authenticity, or reliability. The manipulation may affect stored records, data moving between systems, or information generated and presented while an application is operating.

Data integrity manipulation may be intended to influence a business process, conceal activity, mislead stakeholders, obtain personal benefit, cause operational harm, or undermine organizational decision-making. Affected information may include financial records, customer data, operational measurements, transactions, case records, communications, database entries, system outputs, or other information relied upon by the organization.

A subject may search for, or otherwise explore files on a Network Attached Storage (NAS) device to identify sensitive information.

A subject may search for or otherwise explore files on a Collaboration Platform (such as SharePoint, OneDrive, Confluence, etc) to identify sensitive or valuable information.

A subject embeds data within image files to hide sensitive content and exfiltrate it, in a way that conceals both the data and the act of exfiltration. Unlike encryption alone, this attempts to hide the existence of the data.

Trade-offs

• LSB and EOF: High capacity, low complexity, fragile to inspection
• Transform and Edge-based: Higher stealth, lower capacity, more resilient
• Appended EOF: Minimal technical skill required, common in low-effort exfiltration attempts

A subject deletes organizational files or data (manually or through tooling) outside authorized workflows, resulting in the loss, concealment, or unavailability of operational assets. This infringement encompasses both targeted deletion (e.g. selected records, logs, or documents) and bulk removal (e.g. recursive deletion of directories or volumes).

Unlike Destructive Malware Deployment, which uses self-propagating or malicious code to irreversibly damage systems, this behavior reflects direct user-driven actions or scripts that remove or purge data without employing destructive payloads. Deletions may be conducted via built-in utilities, custom scripts, scheduled tasks, or misuse of administrative tools such as backup managers or version control systems.

This activity frequently occurs to:

• Conceal evidence of other infringing actions (e.g. log deletion to frustrate investigation)
• Sabotage availability of critical information (e.g. deleting shared drives or project directories)
• Facilitate exfiltration or preparation (e.g. purging redundant files before copying sensitive data)

It may also involve secondary actions such as emptying recycle bins, purging shadow copies, disabling version histories, or wiping removable media to obscure the scope of deletion.

The subject modifies startup folders, Registry autorun locations, XDG autostart entries, login items, shortcuts, or equivalent configurations so that unauthorized code executes during system startup or account logon.

The subject adds, replaces, or modifies a Secure Shell (SSH) authorized key or related trust configuration to preserve unauthorized remote access to a system, virtual machine, hypervisor, or network device.

The subject places or modifies a server-side script, application file, or web component that permits unauthorized remote command execution through a web server or hosted application.

The subject bypasses, manipulates, or abuses a technical control intended to regulate elevated execution or access to protected capabilities. This may include abuse of set-user-ID or set-group-ID permissions, bypass of Windows User Account Control, manipulation of sudoers or cached sudo authorization, or alteration of platform consent and privacy controls.

This Sub-section concerns defeating or misusing the elevation control itself.

The subject inserts, deletes, alters, substitutes, or suppresses data retained within an organizational system so that the authoritative record becomes inaccurate, incomplete, misleading, or unreliable.

Affected information may include database entries, business records, documents, stored communications, transactions, customer records, inventory values, measurements, or case information.

The subject modifies an application, executable, library, extension, runtime component, or processing pathway so that organizational data is altered as it is accessed, processed, rendered, or displayed.

The underlying stored data may remain unchanged while an operator, customer, investigator, or decision-maker is presented with inaccurate, incomplete, suppressed, or substituted information. The behavior may conceal transactions, alter displayed values, omit selected records, or cause an application to present information that differs from its authoritative source.

A subject attempts to access a system, repository, application, physical area, account, record set, or other restricted resource to determine whether the applicable access control prevents entry or generates a response.

The subject may use their own identity to request or attempt access slightly outside their normal responsibilities, test an expired or unauthorized physical identity token, navigate directly to a restricted application resource, or attempt to view information associated with another team, customer, case, or business function.

The action may be deliberately limited so that it can be described as accidental if challenged. Repeated denied attempts, access testing across several resources, or a later successful entry may indicate that the subject is mapping authorization boundaries before conducting unauthorized access or another infringement.

A subject can access credentials, tokens, keys, connection strings, or other authentication material recorded within internal documentation, runbooks, wikis, shared notes, or knowledge-management systems.

Credentials may have been added to support troubleshooting, maintenance, deployment, or operational handover, but remain available to a wider population than intended. Historical versions, attachments, comments, and exported copies may continue to expose the material after it has been removed from the visible document.

Access to these repositories may allow a subject to obtain authentication material without being formally granted access to the system or account it protects.

A subject intentionally alters host-based log records to conceal, misattribute, or misrepresent activity conducted on an endpoint, server, or other operating system.

The subject may change timestamps, account names, event identifiers, source addresses, command details, or action outcomes within Windows Event Logs, Linux system or audit logs, macOS logs, security-agent logs, or other locally stored records. Modification may be performed using administrative tools, scripts, third-party log scrubbers, or direct access to .evtx, .log, or other log files.

Investigators should compare local records with centrally forwarded logs, Endpoint Detection and Response (EDR) telemetry, process execution records, file metadata, and File Integrity Monitoring (FIM) events. This Sub-section applies where log content is altered but the record or log remains present.

A subject intentionally alters audit, authentication, access, transaction, or administrative records generated by an organizational application to conceal or misrepresent activity conducted through that application.

The subject may change the recorded actor, timestamp, source address, action, affected object, approval state, or result. Modification may be performed through application administration functionality, an Application Programming Interface (API), direct database access, scripts, or access to the underlying log repository.

Investigators should compare application records with identity logs, database activity, endpoint telemetry, web proxy records, workflow history, and relevant business records.