Cyber Hunting For Defense Evasion Via Timestomping
ASecurity
Detect NTFS timestamp manipulation (MITRE T1070.006) by comparing $STANDARD_INFORMATION vs $FILE_NAME timestamps in the MFT. Uses analyzeMFT and Python to identify files with anomalous temporal patterns indicating anti-forensic timestomping activity.
Installs into .claude/skills of the current project.
Are you the author of Cyber Hunting For Defense Evasion Via Timestomping?
Add the live security badge to your README. It updates with every re-scan.
[](https://www.skillsdirectory.com/skills/nexuslinkproductions-cyber-hunting-for-defense-evasion-via-timestomping)
---
name: cyber-hunting-for-defense-evasion-via-timestomping
description: "Detect NTFS timestamp manipulation (MITRE T1070.006) by comparing $STANDARD_INFORMATION vs $FILE_NAME timestamps in the MFT. Uses analyzeMFT and Python to identify files with anomalous temporal patterns indicating anti-forensic timestomping activity."
hide: true
---
<!-- GENERATED:YURI-CODEX-SKILL-ADAPTER:v1 -->
# YURI skill adapter
Authoritative source: `.claude/skills/cyber-hunting-for-defense-evasion-via-timestomping/SKILL.md`
Authoritative source SHA-256: `cbc01d77ae99fa8600def00d8e198b9896ffa64bcd8bcb5b8b6a6226cd66e2e3`
Source class: `cyber-armed`
Before acting, read the authoritative source file above completely from beginning to end. If the governed source is absent, run `node _SYSTEM/Scripts/skill-recall.mjs --show cyber-hunting-for-defense-evasion-via-timestomping` and read its complete verified output. Follow that source as the skill body; this adapter is a non-authoritative metadata-and-pointer projection.
