LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Fsutil.exe

View source

File System Utility

TamperExecute
04COMMAND EXAMPLES
03ATT&CK TECHNIQUES
01DETECTION RESOURCES
02CAPABILITIES
01 / TRADECRAFT

Command reference

4 examples

Tamper3

EXAMPLE 01T1485

Zero out a file

COMMAND
fsutil.exe file setZeroData offset=0 length=9999999999 {PATH_ABSOLUTE}
USE CASE
Can be used to forensically erase a file
PRIVILEGES
User
OPERATING SYSTEM
Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10
EXAMPLE 02T1485

Delete the USN journal volume to hide file creation activity

COMMAND
fsutil.exe usn deletejournal /d c:
USE CASE
Can be used to hide file creation activity
PRIVILEGES
User
OPERATING SYSTEM
Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10
EXAMPLE 03T1562.001

Instantly creates a new file of any specified size to exhaust free disk space.

COMMAND
fsutil.exe file createnew {PATH_ABSOLUTE} {LENGTH_IN_BYTES}
USE CASE
Exhaust available disk space to impair defensive tools (preventing Windows Defender updates and halting local logging) or cause endpoint denial of service.
PRIVILEGES
User
OPERATING SYSTEM
Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

Execute1

EXAMPLE 01T1218

Executes a pre-planted binary named netsh.exe from the current directory.

COMMAND
fsutil.exe trace decode
USE CASE
Spawn a pre-planted executable from fsutil.exe.
PRIVILEGES
User
OPERATING SYSTEM
Windows 11
Execute · EXE
02 / ON DISK

Known paths

C:\Windows\System32\fsutil.exe
C:\Windows\SysWOW64\fsutil.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources

Indicators & detection notes

  • IOC

    fsutil.exe should not be run on a normal workstation

  • IOC

    file setZeroData (not case-sensitive) in the process arguments

  • IOC

    file createnew (not case-sensitive) in the process arguments

  • IOC

    Sysmon Event ID 1

  • IOC

    Sysmon Event ID 11

  • IOC

    Execution of process fsutil.exe with trace decode could be suspicious

  • IOC

    Non-Windows netsh.exe execution

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Elliot Killick@elliotkillick
Jimmy@bohops
Grzegorz Tworek@0gtweet
MSNightmare@MSNightmare
DevCop95@DevCop95