Fsutil.exe

Commands

1. TamperUser T1485

   Can be used to forensically erase a file

   fsutil.exe file setZeroData offset=0 length=9999999999 {PATH_ABSOLUTE}

   Zero out a file

   os: Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10

2. TamperUser T1485

   Can be used to hide file creation activity

   fsutil.exe usn deletejournal /d c:

   Delete the USN journal volume to hide file creation activity

   os: Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10

3. ExecuteUser T1218

   Spawn a pre-planted executable from fsutil.exe.

   fsutil.exe trace decode

   Executes a pre-planted binary named netsh.exe from the current directory.

   os: Windows 11

   Execute: EXE

Detection

• IOCfsutil.exe should not be run on a normal workstation
• IOCfile setZeroData (not case-sensitive) in the process arguments
• IOCSysmon Event ID 1
• IOCExecution of process fsutil.exe with trace decode could be suspicious
• IOCNon-Windows netsh.exe execution
• Sigma https://github.com/SigmaHQ/sigma/blob/ff5102832031425f6eed011dd3a2e62653008c94/rules/windows/process_creation/proc_creation_win_susp_fsutil_usage.yml

Resources

• https://twitter.com/0gtweet/status/1720724516324704404