{"id":"add64136-62e5-48ea-807e-88638d02df1e","title":"Fsutil Suspicious Invocation","description":"Detects suspicious parameters of fsutil (deleting USN journal, configuring it with small size, etc).\nMight be used by ransomwares during the attack (seen by NotPetya and others).\n","author":"Ecco, E.M. Anhaus, oscd.community","status":"stable","level":"high","date":"2019-09-26","modified":"2023-09-09","tags":["attack.impact","attack.stealth","attack.t1070","attack.t1485"],"technique_ids":["T1070","T1485"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Admin activity","Scripts and administrative tools used in the monitored environment"],"references":["https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-usn","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070/T1070.md","https://eqllib.readthedocs.io/en/latest/analytics/c91f422a-5214-4b17-8664-c5fcf115c0a2.html","https://github.com/albertzsigovits/malware-notes/blob/558898932c1579ff589290092a2c8febefc3a4c9/Ransomware/Lockbit.md","https://blog.cluster25.duskrise.com/2023/05/22/back-in-black-blackbyte-nt"],"source_path":"rules/windows/process_creation/proc_creation_win_fsutil_usage.yml","source_sha256":"81cd99db0548c5dc4de9cc98f5800809ef6437c16c76ee6e1c1711f6a6c8ff93","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_fsutil_usage.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Fsutil Suspicious Invocation\nid: add64136-62e5-48ea-807e-88638d02df1e\nstatus: stable\ndescription: |\n  Detects suspicious parameters of fsutil (deleting USN journal, configuring it with small size, etc).\n  Might be used by ransomwares during the attack (seen by NotPetya and others).\nreferences:\n    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-usn\n    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070/T1070.md\n    - https://eqllib.readthedocs.io/en/latest/analytics/c91f422a-5214-4b17-8664-c5fcf115c0a2.html\n    - https://github.com/albertzsigovits/malware-notes/blob/558898932c1579ff589290092a2c8febefc3a4c9/Ransomware/Lockbit.md\n    - https://blog.cluster25.duskrise.com/2023/05/22/back-in-black-blackbyte-nt\nauthor: Ecco, E.M. Anhaus, oscd.community\ndate: 2019-09-26\nmodified: 2023-09-09\ntags:\n    - attack.impact\n    - attack.stealth\n    - attack.t1070\n    - attack.t1485\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith: '\\fsutil.exe'\n        - OriginalFileName: 'fsutil.exe'\n    selection_cli:\n        CommandLine|contains:\n            - 'deletejournal'        # usn deletejournal ==> generally ransomware or attacker\n            - 'createjournal'        # usn createjournal ==> can modify config to set it to a tiny size\n            - 'setZeroData'          # file setZeroData  ==> empties a file with zeroes\n    condition: all of selection_*\nfalsepositives:\n    - Admin activity\n    - Scripts and administrative tools used in the monitored environment\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1070","id":"T1070","name":"Indicator Removal","page":"techniques/enterprise/T1070/"},{"key":"enterprise/T1485","id":"T1485","name":"Data Destruction","page":"techniques/enterprise/T1485/"}],"data_path":"data/detection-rules/add64136-62e5-48ea-807e-88638d02df1e.json","kind":"sigma"}