Windows fsutil.exe Suspicious USN Journal and File Zeroing Commands

title: Windows fsutil.exe Suspicious USN Journal and File Zeroing Commands
id: 050621ad-d6f5-46be-be0a-d2d861b6094c
status: stable
description: This rule flags execution of fsutil.exe with command-line arguments consistent with USN journal manipulation (deletejournal or createjournal) and file content wiping (setZeroData). Attackers may use these actions to impair forensic visibility or affect on-disk artifacts during impact or stealth activities. The detection relies on Windows process creation telemetry, matching the process image/original filename and specific command-line substrings.
references:
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-usn
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070/T1070.md
  - https://eqllib.readthedocs.io/en/latest/analytics/c91f422a-5214-4b17-8664-c5fcf115c0a2.html
  - https://github.com/albertzsigovits/malware-notes/blob/558898932c1579ff589290092a2c8febefc3a4c9/Ransomware/Lockbit.md
  - https://blog.cluster25.duskrise.com/2023/05/22/back-in-black-blackbyte-nt
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_fsutil_usage.yml
author: Ecco, E.M. Anhaus, oscd.community, Huntrule Team
date: 2019-09-26
modified: 2023-09-09
tags:
  - attack.impact
  - attack.stealth
  - attack.t1070
  - attack.t1485
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \fsutil.exe
    - OriginalFileName: fsutil.exe
  selection_cli:
    CommandLine|contains:
      - deletejournal
      - createjournal
      - setZeroData
  condition: all of selection_*
falsepositives:
  - Admin activity
  - Scripts and administrative tools used in the monitored environment
level: high
license: DRL-1.1
related:
  - id: add64136-62e5-48ea-807e-88638d02df1e
    type: derived