Sysmon Event ID 2: A process changed a file creation time
Sysmon Event ID 2 records that a monitored process changed the creation timestamp of a file, capturing both the new CreationUtcTime and the file's PreviousCreationUtcTime.
- Applicable version
- Sysmon 2.0 and later
- Last reviewed
- 2026-07-12
Trigger Scenarios
Sysmon logs Event ID 2 whenever a monitored process changes a file's creation time using SetFileTime or an equivalent API. Software installers that preserve packaged timestamps, archive extraction tools, and file-copy utilities with timestamp-preservation flags generate this event legitimately; so do deliberate timestomping tools such as SetMACE or scripted calls to .NET's File.SetCreationTime.
Key Fields
CreationUtcTime / PreviousCreationUtcTime
The exact new and prior creation timestamps. A CreationUtcTime set earlier than PreviousCreationUtcTime, or earlier than the file's own compile timestamp or the host's OS install date, is inconsistent with normal file lifecycle and is Sysmon's direct timestomping signal.
TargetFilename
Full path of the file whose creation time changed. Files dropped into user-writable or temp directories are higher risk than timestamp changes on files under vendor installer paths.
Image / ProcessGuid
The process that performed the modification. ProcessGuid joins this event to the exact Event ID 1 process-creation record for that process's lifetime.
User
The account context of the process performing the change; compare against the account's normal administrative or deployment role.
Common False Positives
- Many MSI-based installers intentionally preserve packaged timestamps on extracted files, producing a legitimate backdated CreationUtcTime.
- Archive extraction tools (7-Zip, tar) and robocopy /COPY:DAT commonly restore original timestamps during file copies.
- Git checkouts and build pipelines that restore source timestamps from version control metadata.
Related Events
MITRE ATT&CK Mapping
- T1070.006Indicator Removal: Timestomp
Detection Notes
T1070.006 timestomping is concrete when PreviousCreationUtcTime and CreationUtcTime differ and the changed TargetFilename is under C:\\Users\\ or C:\\ProgramData\\. Compare the new time to the creating Event ID 11 time; a backdated executable conceals staging.
Sysmon
| where EventID == 2
| where CreationUtcTime < PreviousCreationUtcTime
| project TimeGenerated, Computer, User, Image, TargetFilename, PreviousCreationUtcTime, CreationUtcTimeindex=sysmon EventCode=2
| eval backdated=if(strptime(CreationUtcTime,"%Y-%m-%d %H:%M:%S") < strptime(PreviousCreationUtcTime,"%Y-%m-%d %H:%M:%S"), 1, 0)
| search backdated=1
| table _time, host, User, Image, TargetFilename, PreviousCreationUtcTime, CreationUtcTimeUtcTime: 2026-07-12 09:14:02.331
ProcessGuid: {11111111-2222-3333-4444-555555555555}
ProcessId: 5210
Image: C:\Users\Public\tools\setmace.exe
TargetFilename: C:\Windows\Temp\payload.exe
CreationUtcTime: 2019-03-01 00:00:00.000
PreviousCreationUtcTime: 2026-07-12 09:13:58.104
User: CORP\jsmith