Fsutil.exe

Commands

1. TamperUser T1485

   Can be used to forensically erase a file

   fsutil.exe file setZeroData offset=0 length=9999999999 {PATH_ABSOLUTE}

   Zero out a file

   os: Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10

2. TamperUser T1485

   Can be used to hide file creation activity

   fsutil.exe usn deletejournal /d c:

   Delete the USN journal volume to hide file creation activity

   os: Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10

3. ExecuteUser T1218

   Spawn a pre-planted executable from fsutil.exe.

   fsutil.exe trace decode

   Executes a pre-planted binary named netsh.exe from the current directory.

   os: Windows 11

   Execute: EXE

4. TamperUser T1562.001

   Exhaust available disk space to impair defensive tools (preventing Windows Defender updates and halting local logging) or cause endpoint denial of service.

   fsutil.exe file createnew {PATH_ABSOLUTE} {LENGTH_IN_BYTES}

   Instantly creates a new file of any specified size to exhaust free disk space.

   os: Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

Detection

• IOCfsutil.exe should not be run on a normal workstation
• IOCfile setZeroData (not case-sensitive) in the process arguments
• IOCfile createnew (not case-sensitive) in the process arguments
• IOCSysmon Event ID 1
• IOCSysmon Event ID 11
• IOCExecution of process fsutil.exe with trace decode could be suspicious
• IOCNon-Windows netsh.exe execution
• Sigma https://github.com/SigmaHQ/sigma/blob/ff5102832031425f6eed011dd3a2e62653008c94/rules/windows/process_creation/proc_creation_win_susp_fsutil_usage.yml

Resources

• https://twitter.com/0gtweet/status/1720724516324704404
• https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-file
• https://github.com/MSNightmare/BigDiskBuster
• https://github.com/DevCop95/BDB-Guardian