Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

remote file creation: use parent folder's mtime instead of current time #43

Open
nil0x42 opened this issue Nov 23, 2016 · 1 comment
Open
Labels
enhancement stealth impacts stealthness and evasion capabilities
Milestone

Comments

@nil0x42
Copy link
Owner

nil0x42 commented Nov 23, 2016

parent directory of altered files needs to have mtime restored too

@nil0x42
Copy link
Owner Author

nil0x42 commented Nov 29, 2016

UPDATE:
The real problem is about creating new files.

When a new file is created in a parent folder, the parent folder's mtime will be immediately altered.
So, to improve stealth, when creating a new file, parent folder's mtime should be used instead of current mtime.

If the file is removed by us later, we're then keeping no traces of our actions.

@nil0x42 nil0x42 added the stealth impacts stealthness and evasion capabilities label Jan 15, 2019
@nil0x42 nil0x42 added this to the Release 3.1 milestone Jan 15, 2019
@nil0x42 nil0x42 changed the title parent directory of altered files needs to have mtime restored too remote file creation: use parent folder's mtime instead of current time Jan 15, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement stealth impacts stealthness and evasion capabilities
Projects
None yet
Development

No branches or pull requests

1 participant