Log Dejargonizer

Sysmon · Event 2

Sysmon Event 2: A file's creation time was changed

A program rewrote a file's creation timestamp. Very little legitimate software does this, and altering timestamps to blend into a directory is a well-known anti-forensics move — which makes this a low-volume, high-signal event.

Also written as Sysmon 2Sysmon Event ID 2timestomping detection

What it means for you

On a personal computer

Only present if you installed Sysmon. It records a program changing when a file claims to have been created.

For an analyst

Sysmon reports both the previous and the new value, so you can see what the timestamp was changed from. A file backdated to match the surrounding directory is the classic pattern. Note this covers creation time only — an attacker altering modified or accessed times will not appear here.

What it looks like

Sanitised. Addresses come from the RFC 5737 documentation ranges.

Sample
File creation time changed:
  RuleName: T1070.006
  UtcTime: 2026-08-28 09:16:44.201
  ProcessGuid: {a1b2c3d4-0000-0000-0000-00000000abcd}
  ProcessId: 7412
  Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  TargetFilename: C:\Windows\System32\wh.exe
  CreationUtcTime: 2019-03-19 04:32:11.000
  PreviousCreationUtcTime: 2026-08-28 09:14:09.001
  User: CORP\jbrooks

The fields that decide it

Everything else in the log line is context.

TargetFilename
The file whose timestamp changed. Its location matters as much as the change.
Image
The process that made the change. Archive tools and installers are the usual benign sources; a shell is not.
CreationUtcTime
The new creation time being written.
  • A date matching surrounding system filesDeliberately backdated to blend in. The classic timestomping pattern.
  • A date far in the pastAlso blending in, more crudely.
PreviousCreationUtcTime
What the timestamp was before. Comparing the two is the whole event.
User
The account the changing process ran under.

Ordinary reasons this happens

Most of the time it is one of these.

  • Archive tools restoring original timestamps when extracting files.
  • Backup and synchronisation software preserving metadata.
  • Installers setting timestamps on files they lay down.
  • Build tools and version control preserving file times.
  • File copy utilities configured to keep original attributes.

When it is not ordinary

Timestomping to hide a dropped file.

What gives it awayA file's creation time changed to match surrounding system files, usually shortly after it was written.

ATT&CK T1070.006

Backdating a web shell or payload.

What gives it awayA timestamp change on a script or executable in a web root or system directory.

ATT&CK T1070.006

Frustrating timeline reconstruction.

What gives it awaySeveral files in one directory having their timestamps changed by the same process in quick succession.

ATT&CK T1070.006

What to do next

  1. Compare the previous and new timestamps. A change to match nearby files is the giveaway.
  2. Check what kind of process made the change. An archive tool is ordinary; a shell or scripting engine is not.
  3. Check Sysmon Event 11 for when the file was actually created — that is the real time.
  4. Look at the file's location. System directories and web roots matter more than user documents.
  5. Join on ProcessGuid for the changing process's command line and parent.
  6. Treat the file as suspect regardless of what its timestamps now claim.

Queries to run

kql Low enough volume to read in full once archive and backup tooling is excluded. 
Event | where Source == 'Microsoft-Windows-Sysmon' and EventID == 2 | project TimeGenerated, Computer, Image, TargetFilename, User | order by TimeGenerated desc
kql Shells changing timestamps. Very close to a standalone alert. 
Event | where Source == 'Microsoft-Windows-Sysmon' and EventID == 2 | extend Proc = tostring(split(Image, '\\')[-1]) | where Proc in~ ('powershell.exe','cmd.exe','wscript.exe','cscript.exe') | project TimeGenerated, Computer, Proc, TargetFilename

Common questions

What is timestomping?

Changing a file's timestamps so it appears to have been created at a different time, usually one that matches the surrounding files. The point is to survive a look at a directory sorted by date, and to break timeline reconstruction during an investigation. Sysmon Event 2 records the change and, usefully, what the value was before.

Does Sysmon Event 2 catch all timestamp manipulation?

No. It covers creation time only. Modified and accessed times can be changed without producing this event, and an attacker altering the file system record directly rather than through the normal API will not appear here either. It catches the common case, not every case.

Is Event 2 ever legitimate?

Yes, but the list is short. Archive tools restoring original timestamps on extraction, backup software preserving metadata, and some installers all do it. That baseline is small and consistent enough to exclude by process name, which leaves a genuinely useful signal.

Read next

Vendor documentation

Last reviewed 28 August 2026