Windows fsutil Drive Enumeration via drives Argument

Flags fsutil.exe process launches with command lines referencing connected drive enumeration.

FreeUnreviewedSigmalowv1

windows-fsutil-drive-enumeration-via-drives-argument-63de06b9

title: Windows fsutil Drive Enumeration via drives Argument
id: 5df92dc7-147e-41c0-adce-229f719af6dd
status: test
description: This rule identifies Windows processes executing fsutil.exe with command lines containing the substring "drives". Attackers can use fsutil to enumerate connected storage drives to inform later discovery and targeting decisions. It relies on process creation telemetry, using executable name matching and command-line content inspection.
references:
  - Turla has used fsutil fsinfo drives to list connected drives.
  - https://github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/discovery_peripheral_device.toml
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_fsutil_drive_enumeration.yml
author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Huntrule Team
date: 2022-03-29
modified: 2022-07-14
tags:
  - attack.discovery
  - attack.t1120
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \fsutil.exe
    - OriginalFileName: fsutil.exe
  selection_cli:
    CommandLine|contains: drives
  condition: all of selection_*
falsepositives:
  - Certain software or administrative tasks may trigger false positives.
level: low
license: DRL-1.1
related:
  - id: 63de06b9-a385-40b5-8b32-73f2b9ef84b6
    type: derived

What it detects

This rule identifies Windows processes executing fsutil.exe with command lines containing the substring "drives". Attackers can use fsutil to enumerate connected storage drives to inform later discovery and targeting decisions. It relies on process creation telemetry, using executable name matching and command-line content inspection.

Known false positives

Certain software or administrative tasks may trigger false positives.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.