Windows fsutil.exe Drive Enumeration via Process Execution
Flags fsutil.exe process launches with command lines referencing connected drive enumeration.
- Product
- windows
- Category
- process_creation
- Author
- Christopher Peacock '@securepeacock', SCYTHE '@scythe_io' (SigmaHQ), DRL 1.1
- Published
- 2022-03-29
- Updated
- 2026-07-31
ATT&CK techniques
DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags execution of fsutil.exe where the command line includes the string "drives", indicating an attempt to enumerate connected drives. Attackers commonly use built-in utilities for discovery to map local storage before staging follow-on activity. The detection relies on Windows process creation telemetry, matching the executed image and the command-line content.
Reporting behind it
- Turla has used fsutil fsinfo drives to list connected drives.Turla has used fsutil fsinfo drives to list connected drives.
- github.comhttps://github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/discovery_peripheral_device.toml
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_fsutil_drive_enumeration.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows fsutil.exe Drive Enumeration via Process Execution
id: 5df92dc7-147e-41c0-adce-229f719af6dd
status: test
description: This rule flags execution of fsutil.exe where the command line includes the string "drives", indicating an attempt to enumerate connected drives. Attackers commonly use built-in utilities for discovery to map local storage before staging follow-on activity. The detection relies on Windows process creation telemetry, matching the executed image and the command-line content.
references:
- Turla has used fsutil fsinfo drives to list connected drives.
- https://github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/discovery_peripheral_device.toml
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_fsutil_drive_enumeration.yml
author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Huntrule Team
date: 2022-03-29
modified: 2022-07-14
tags:
- attack.discovery
- attack.t1120
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \fsutil.exe
- OriginalFileName: fsutil.exe
selection_cli:
CommandLine|contains: drives
condition: all of selection_*
falsepositives:
- Certain software or administrative tasks may trigger false positives.
level: low
license: DRL-1.1
related:
- id: 63de06b9-a385-40b5-8b32-73f2b9ef84b6
type: derived