Prevent Timestomping in Launch Directories

One way that malicious software covers its tracks is by timestomping, or setting the timestamps of malicious files to match legitimate ones to make timeline analysis more difficult. As Jaron Bradley points out, this is commonly done when achieving persistence through the LaunchAgents and LaunchDaemons directories. Malware can use the built-in touch command with seldom-used flags, such as -r, which copies the timestamp from one file to another.

In Santa versions 2025.12+ you can write a better rule that accounts for the current working directory (cwd). To harden this further, you could use a file access rule, which was demonstrated by Kristin Smith at BSides Canberra 2025.