Windows fsutil SymlinkEvaluation Behavior Change via cmd or PowerShell

title: Windows fsutil SymlinkEvaluation Behavior Change via cmd or PowerShell
id: 5351bb2b-5ac6-4113-9b0a-73e0ac521edb
status: test
description: This rule flags process executions where fsutil is used to set NTFS SymlinkEvaluation behavior, including remote-to-local or remote-to-remote symlink enablement indicators. Attackers may use these behavior changes to facilitate later access or redirection through symlinks. The detection relies on Windows process creation telemetry, matching command lines issued from cmd.exe or PowerShell and the presence of fsutil behavior set parameters plus R2L/R2R/L2L values.
references:
  - https://www.cybereason.com/blog/cybereason-vs.-blackcat-ransomware
  - https://learn.microsoft.com/fr-fr/windows-server/administration/windows-commands/fsutil-behavior
  - https://thedfirreport.com/2025/06/30/hide-your-rdp-password-spray-leads-to-ransomhub-deployment/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_fsutil_symlinkevaluation.yml
author: frack113, The DFIR Report, Huntrule Team
date: 2022-03-02
modified: 2025-11-13
tags:
  - attack.execution
  - attack.defense-impairment
  - attack.t1059
  - attack.t1222.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img_proxy:
    - Image|endswith:
        - \cmd.exe
        - \powershell.exe
        - \pwsh.exe
    - OriginalFileName:
        - Cmd.Exe
        - PowerShell.EXE
        - pwsh.dll
  selection_fsutil_cli:
    CommandLine|contains|all:
      - fsutil
      - behavior
      - set
      - SymlinkEvaluation
  selection_symlink_params:
    CommandLine|contains:
      - R2L:1
      - R2R:1
      - L2L:1
  condition: all of selection_*
falsepositives:
  - Legitimate usage, investigate the parent process and context to determine if benign.
level: medium
license: DRL-1.1
related:
  - id: c0b2768a-dd06-4671-8339-b16ca8d1f27f
    type: derived