Timestomping Detected via Touch

process where event.type == "start" and event.action == "exec" and process.name == "touch" and
process.parent.executable != null and process.args like (
  "-t*", "-d*", "-a*", "-m*", "-r*", "--date=*", "--reference=*", "--time=*"
) and process.args like (
  "/etc/*", "/bin/*", "/usr/bin/*", "/sbin/*", "/usr/sbin/*", "/opt/*", "/dev/shm/*",
  "/var/tmp/*", "/boot/*", "/root/*", "/usr/lib*", "/lib*"
) and not (
  process.parent.executable in (
    "/usr/local/bin/manage_omnimesh_logs", "/pro/bin/sys/install/packageUtils.sh", "/bin/dracut",
    "/usr/libexec/postfix/aliasesdb", "pwsh-preview", "/usr/bin/dracut", "/usr/share/initramfs-tools/hooks/amd64_microcode",
    "/usr/local/bin/start-mailserver.sh", "/usr/bin/ssm-agent-worker", "/bin/ssm-agent-worker", "/usr/local/cpanel/scripts/restartsrv_bind",
    "/usr/bin/vmtoolsd", "/usr/local/cpanel/bin/restartsrv_base", "/usr/lib/pcp/bin/pmie_check"
  ) or
  process.parent.executable like (
    "/opt/sw/tomcat/rc_scripts/*", "/tmp/newroot/var/lib/docker/overlay2/*", "/snap/*", "/opt/zeek/*", "/home/*/bin/ndex-rm.sh",
    "/root/.cache/act/*/staging_dir/host/bin/bash"
  ) or
  process.parent.name in (
    "xargs", "find", "sudo", "make", "pmlogger_check", "pmlogger_daily", "pmlogger_janitor", "autoupdate", "pmlogctl",
    "spyglass", "desktop-launch", "pmiectl"
  ) or
  process.parent.args like (
    "/home/*/scripts/auto_download_process.py", "/home/*/scripts/perl_python_eagu1p.py", "/var/lib/dpkg/info/*",
    "bazel-out/k8-dbg/bin/dependencies/thirdparty/libjansson_foreign_cc/build_script.sh", "/usr/lib/portage/python*/ebuild.sh",
    "/var/tmp/rpm-tmp.*", "/usr/lib/pcp/bin/pmlogger_janitor", "/usr/libexec/pcp/bin/pmlogger_janitor",
    "/usr/libexec/pcp/bin/pmlogger_daily", "/usr/lib/pcp/bin/pmlogger_daily", "/opt/oracle.ExaWatcher/GetExaWatcherResults.sh",
    "bazel-out/k8-dbg/bin/external/libzip+/libzip_foreign_cc/build_script.sh", "/builds/*/IP/embedded/platforms/stratawave-yocto/build/*/temp/run.sstate_unpack_package*",
    "/usr/local/bin/manage_omnimesh_logs"
  ) or
  process.args in (
    "/usr/bin/coreutils", "--no-create", "/etc/opt/lumu/lumud.conf", "/opt/vuso*", "/opt/diff", "/etc/aliases.db", "/opt/cursor/cursor"
  ) or
  process.args like (
    "--checkpoint=*", "/root/.config/envman/*", "/var/tmp/dracut*", "/var/tmp/portage*", "/snap/*", "/var/tmp/pmlogger_*/stamp",
    "/opt/ubki/*.jar", "/root/.cache/bazel/_bazel_root/*", "/root/.cache/act/*/hostexecutor/matrix/*/tmp/*.o",
    "/opt/ubki/*/cassandra-repair-dev-test/*"
  ) or
  process.command_line in (
    "/bin/touch -a /tmp/au_status", "touch -d 2 seconds ago /etc/postfix/main.cf", "touch -a /etc/apt/client.key /etc/apt/client.crt",
    "touch -r /etc/aliases.lmdb /var/lib/misc/postfix.aliasesdb-stamp"
  ) or
  process.parent.command_line == "runc init" or
  process.working_directory in ("/opt/libexec", "/opt/local/src/connectxx/build/src/mdp") or
  (process.args like "/var/tmp/pmlogger_check.*/_stamp" and process.parent.args == "/usr/libexec/pcp/bin/pmlogger_check") or
  (process.parent.executable == "/usr/bin/ninja" and process.parent.command_line like "ninja*") or
  (
    process.command_line like "touch -r /etc/horcNEW.conf /etc/horcm*.conf" and
    process.parent.command_line like "bash -c cat - > '/etc/horcm*.conf'; touch -r '/etc/horcNEW.conf' '/etc/horcm*.conf'"
  )
)