timestomp

Rapid7 Meterpreter's Windows timestomp privilege command displays or changes a file's MACE (modified, accessed, created, and MFT-entry-modified) timestamps. This record includes a read-only inspection example and a last-write timestamp example; upstream also supports other timestamp operations. Timestamp modification is associated with defense evasion (MITRE ATT&CK T1070.006).