How can an attacker modify file timestamps to cover tracks after deploying files on a target system?

An attacker can use tools like FileTimeControl_WinAPI (via SetFileTime) to modify CreateTime, AccessTime, and LastWriteTime, or FileTimeControl_NTAPI (via NtSetInformationFile) to also modify MFTChangeTime. To fully eliminate traces, they may need to use low-level tools like WinHex to directly alter the $STANDARD_INFORMATION and $FILE_NAME attributes in the Master File Table. --- **Related reading:** - [Penetration Techniques - Time Attributes of NTFS Files in Windows](/news/penetration-techniques-time-attributes-of-ntfs-files-in-windows) — original article - [Zimbra SOAP API Development Guide](/news/zimbra-soap-api-development-guide) - [Unauthorized file copying via COM component IFileOperation](/news/unauthorized-file-copying-via-com-component-ifileoperation) - [Setting Up ADAudit Plus Vulnerability Debugging Environment](/news/setting-up-adaudit-plus-vulnerability-debugging-environment)