Malicious Registry Timestamp Manipulation Technique: Detecting Registry Timestomping
Registry artifact timestamps are extremely important to an incident response investigation. Threat actors may hide persistence mechanisms within the registry or modify registry values to disable Antivirus and other security tools. Knowing the time registry values are set/modified is very important to the overall investigation, especially when faced with answering questions pertaining to… Why did <security_tool> not detect the threat? What files did the threat actors recently view? What folders did the threat actors open? When was the persistence mechanism installed in the registry? And many other questions that are important to an investigation… The idea of timestomping / time manipulation of a registry key’s ‘Last Write’ is a topic that has not been comprehensively covered in DFIR write-ups with most timestomping write-ups focused on timestomping of files via manipulation of the $STANDARD_INFORMATION time. There exists a native Windows API “NtSetInformatio...