The touch Command Attackers Use to Rewrite Your Incident Timeline

touch is one of the first Linux commands every developer learns. Create a file, update a timestamp, move on. Most of us never think about it again.

Turns out it's also one of the simplest defense evasion tools in an attacker's playbook.

Because touch -t and touch -r can rewrite a file's atime and mtime to literally any value, a compromised system's file listing can lie to you. Sort a directory by "date modified" during an incident and a backdated malicious file will sit quietly among files that are months old — no different from any legitimate one nearby. MITRE ATT&CK has a name for this: timestomping (T1070.006).

I wrote up a full technical breakdown covering:

• Complete touch syntax — single/multi-file creation, hidden files, brace expansion, find -exec touch
• How -t and -r flags are used to forge or clone timestamps
• Why stat (mtime vs ctime) beats ls -la for catching tampering
• Real detection methods: auditd watch rules, log correlation, EDR telemetry patterns

If you build tooling for SOC teams, work in incident response, or just want to understand Linux filesystem internals a level deeper, this one's for you.

Full article: https://www.xpert4cyber.com/2026/09/touch-command-timestomping-linux-forensics.html