Sysmon Event ID 2 — A process changed a file creation time — SecOps Tools

Why event 2 matters

Timestomping (T1070.006) — attackers modify file timestamps to evade forensic timeline analysis. Tools: Metasploit timestomp, PowerShell Set-ItemProperty, touch. Legitimate tools rarely modify timestamps. Any backdoor, implant, or lateral movement tool modifying its own timestamp is suspicious.

How to detect it

Alert: any process modifying timestamps outside of known backup or archiving tools. Alert: Image is PowerShell, cmd, or any non-backup tool. Low volume makes this high-fidelity.

Log source

Microsoft-Windows-Sysmon/Operational

Requires Sysmon installed with a config that logs this event (e.g. SwiftOnSecurity / Olaf Hartong).

Fields to pivot on

ImageCommandLineParentImageUserHashes

MITRE ATT&CK mapping

Tactic	Technique
Defense Evasion	Indicator Removal: Timestomp (T1070.006)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sigma rule

title: File Timestamp Modification — Timestomping
status: stable
description: Process modified file creation timestamp
author: theadminstack.com
date: 2026/05/16
logsource:
    category: file_change
    product: windows
detection:
    selection:
        EventID: 2
    filter_legit:
        Image|contains:
            - '\\MsMpEng.exe'
            - '\\thor.exe'
    condition: selection and not filter_legit
falsepositives:
    - Backup software
    - File sync tools
level: medium
tags:
    - attack.defense_evasion
    - attack.t1070.006

Sentinel / Defender KQL

Event
| where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID == 2   // A process changed a file creation time
// EventData holds: Image, CommandLine, ParentImage, User, Hashes
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated desc

Splunk SPL

index=* sourcetype="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=2
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# A process changed a file creation time — add EventData fields: Image, CommandLine, ParentImage, User`

Hunt event 2 in Sentinel/Defender →

Build a KQL query for this event in the KQL Query Builder.

Search all event IDs →

Open the interactive Windows Event ID lookup.

Frequently asked questions

What is Sysmon Event ID 2?

A process changed a file creation time. A process modified a file's creation timestamp. Image (process), TargetFilename, CreationUtcTime, PreviousCreationUtcTime are key.

Which log records event 2?

Event 2 is written to the Microsoft-Windows-Sysmon/Operational channel by Microsoft-Windows-Sysmon. Requires Sysmon installed with a config that logs this event (e.g. SwiftOnSecurity / Olaf Hartong).

What MITRE ATT&CK techniques map to event 2?

Event 2 is associated with: Indicator Removal: Timestomp (T1070.006).

How do you detect activity around event 2?

Alert: any process modifying timestamps outside of known backup or archiving tools. Alert: Image is PowerShell, cmd, or any non-backup tool. Low volume makes this high-fidelity.