Windows fsutil.exe Suspicious USN Journal and File Zeroing Parameters
Alerts when fsutil.exe is run with USN journal deletion/creation or setZeroData-style file zeroing commands.
- Product
- windows
- Category
- process_creation
- Author
- Ecco, E.M. Anhaus, oscd.community (SigmaHQ), DRL 1.1
- Published
- 2019-09-26
- Updated
- 2026-07-31
ATT&CK techniques
Defense Evasion → ImpactRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags execution of fsutil.exe with command-line arguments commonly associated with USN Journal manipulation and file zeroing (deletejournal, createjournal, setZeroData). Attackers may use these actions to hinder forensic recovery by altering NTFS change tracking or to disrupt artifacts by overwriting with zeros. It relies on Windows process creation telemetry, matching on fsutil.exe by image/original filename and inspecting the command line for the listed parameters.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-usn
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070/T1070.md
- eqllib.readthedocs.iohttps://eqllib.readthedocs.io/en/latest/analytics/c91f422a-5214-4b17-8664-c5fcf115c0a2.html
- github.comhttps://github.com/albertzsigovits/malware-notes/blob/558898932c1579ff589290092a2c8febefc3a4c9/Ransomware/Lockbit.md
- blog.cluster25.duskrise.comhttps://blog.cluster25.duskrise.com/2023/05/22/back-in-black-blackbyte-nt
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_fsutil_usage.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows fsutil.exe Suspicious USN Journal and File Zeroing Parameters
id: 050621ad-d6f5-46be-be0a-d2d861b6094c
status: stable
description: This rule flags execution of fsutil.exe with command-line arguments commonly associated with USN Journal manipulation and file zeroing (deletejournal, createjournal, setZeroData). Attackers may use these actions to hinder forensic recovery by altering NTFS change tracking or to disrupt artifacts by overwriting with zeros. It relies on Windows process creation telemetry, matching on fsutil.exe by image/original filename and inspecting the command line for the listed parameters.
references:
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-usn
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070/T1070.md
- https://eqllib.readthedocs.io/en/latest/analytics/c91f422a-5214-4b17-8664-c5fcf115c0a2.html
- https://github.com/albertzsigovits/malware-notes/blob/558898932c1579ff589290092a2c8febefc3a4c9/Ransomware/Lockbit.md
- https://blog.cluster25.duskrise.com/2023/05/22/back-in-black-blackbyte-nt
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_fsutil_usage.yml
author: Ecco, E.M. Anhaus, oscd.community, Huntrule Team
date: 2019-09-26
modified: 2023-09-09
tags:
- attack.impact
- attack.stealth
- attack.t1070
- attack.t1485
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \fsutil.exe
- OriginalFileName: fsutil.exe
selection_cli:
CommandLine|contains:
- deletejournal
- createjournal
- setZeroData
condition: all of selection_*
falsepositives:
- Admin activity
- Scripts and administrative tools used in the monitored environment
level: high
license: DRL-1.1
related:
- id: add64136-62e5-48ea-807e-88638d02df1e
type: derived