{"id":"c0b2768a-dd06-4671-8339-b16ca8d1f27f","title":"Potentially Suspicious NTFS Symlink Behavior Modification","description":"Detects the modification of NTFS symbolic link behavior using fsutil, which could be used to enable remote to local or remote to remote symlinks for potential attacks.\n","author":"frack113, The DFIR Report","status":"test","level":"medium","date":"2022-03-02","modified":"2025-11-13","tags":["attack.execution","attack.defense-impairment","attack.t1059","attack.t1222.001"],"technique_ids":["T1059","T1222.001"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Legitimate usage, investigate the parent process and context to determine if benign."],"references":["https://www.cybereason.com/blog/cybereason-vs.-blackcat-ransomware","https://learn.microsoft.com/fr-fr/windows-server/administration/windows-commands/fsutil-behavior","https://thedfirreport.com/2025/06/30/hide-your-rdp-password-spray-leads-to-ransomhub-deployment/"],"source_path":"rules/windows/process_creation/proc_creation_win_fsutil_symlinkevaluation.yml","source_sha256":"7771ffbbdb573f2177445bbf07cabdeb3c72840804da7cb4bcbaad9fd41f4df3","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_fsutil_symlinkevaluation.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potentially Suspicious NTFS Symlink Behavior Modification\nid: c0b2768a-dd06-4671-8339-b16ca8d1f27f\nstatus: test\ndescription: |\n    Detects the modification of NTFS symbolic link behavior using fsutil, which could be used to enable remote to local or remote to remote symlinks for potential attacks.\nreferences:\n    - https://www.cybereason.com/blog/cybereason-vs.-blackcat-ransomware\n    - https://learn.microsoft.com/fr-fr/windows-server/administration/windows-commands/fsutil-behavior\n    - https://thedfirreport.com/2025/06/30/hide-your-rdp-password-spray-leads-to-ransomhub-deployment/\nauthor: frack113, The DFIR Report\ndate: 2022-03-02\nmodified: 2025-11-13\ntags:\n    - attack.execution\n    - attack.defense-impairment\n    - attack.t1059\n    - attack.t1222.001\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img_proxy:\n        # Note: Example command observed:  cmd.exe /c \"fsutil behaviour set SymlinkEvaluation\"\n        - Image|endswith:\n              - '\\cmd.exe'\n              - '\\powershell.exe'\n              - '\\pwsh.exe'\n        - OriginalFileName:\n              - 'Cmd.Exe'\n              - 'PowerShell.EXE'\n              - 'pwsh.dll'\n    selection_fsutil_cli:\n        CommandLine|contains|all:\n            - 'fsutil'\n            - 'behavior'\n            - 'set'\n            - 'SymlinkEvaluation'\n    selection_symlink_params:\n        CommandLine|contains:\n            - 'R2L:1' # Remote to Local\n            - 'R2R:1' # Remote to Remote\n            - 'L2L:1' # Local to Local\n    condition: all of selection_*\nfalsepositives:\n    - Legitimate usage, investigate the parent process and context to determine if benign.\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059","id":"T1059","name":"Command and Scripting Interpreter","page":"techniques/enterprise/T1059/"},{"key":"enterprise/T1222.001","id":"T1222.001","name":"Windows Permissions","page":"techniques/enterprise/T1222.001/"}],"data_path":"data/detection-rules/c0b2768a-dd06-4671-8339-b16ca8d1f27f.json","kind":"sigma"}