For indicator removal on host: Timestomp the adversary uses a Windows version of the Linux touch command. This makes sure the used tools by the adversary blend in with the other files in the directory when shown in a timeline. Creating a timeline is a common thing to do for forensic analysts to get a chronological view of events on a system