Windows: fsutil SymlinkEvaluation behavior modification via command line
Alerts on fsutil commands from cmd/PowerShell that change NTFS SymlinkEvaluation behavior, potentially enabling remote symlink access.
- Product
- windows
- Category
- process_creation
- Author
- frack113, The DFIR Report (SigmaHQ), DRL 1.1
- Published
- 2022-03-02
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Defense EvasionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process executions where fsutil sets the Windows SymlinkEvaluation behavior, indicating a change to how NTFS symlinks are evaluated. Attackers may use this to allow different symlink target evaluations (such as remote-to-local or remote-to-remote), which can support various access and deception techniques. It relies on Windows process creation telemetry capturing the executable (cmd.exe or PowerShell) and the full command line containing fsutil, behavior set, and SymlinkEvaluation with specific R2L/R2R/L2L parameters.
Reporting behind it
- cybereason.comhttps://www.cybereason.com/blog/cybereason-vs.-blackcat-ransomware
- learn.microsoft.comhttps://learn.microsoft.com/fr-fr/windows-server/administration/windows-commands/fsutil-behavior
- thedfirreport.comhttps://thedfirreport.com/2025/06/30/hide-your-rdp-password-spray-leads-to-ransomhub-deployment/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_fsutil_symlinkevaluation.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: fsutil SymlinkEvaluation behavior modification via command line"
id: 5351bb2b-5ac6-4113-9b0a-73e0ac521edb
status: test
description: This rule flags process executions where fsutil sets the Windows SymlinkEvaluation behavior, indicating a change to how NTFS symlinks are evaluated. Attackers may use this to allow different symlink target evaluations (such as remote-to-local or remote-to-remote), which can support various access and deception techniques. It relies on Windows process creation telemetry capturing the executable (cmd.exe or PowerShell) and the full command line containing fsutil, behavior set, and SymlinkEvaluation with specific R2L/R2R/L2L parameters.
references:
- https://www.cybereason.com/blog/cybereason-vs.-blackcat-ransomware
- https://learn.microsoft.com/fr-fr/windows-server/administration/windows-commands/fsutil-behavior
- https://thedfirreport.com/2025/06/30/hide-your-rdp-password-spray-leads-to-ransomhub-deployment/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_fsutil_symlinkevaluation.yml
author: frack113, The DFIR Report, Huntrule Team
date: 2022-03-02
modified: 2025-11-13
tags:
- attack.execution
- attack.defense-impairment
- attack.t1059
- attack.t1222.001
logsource:
category: process_creation
product: windows
detection:
selection_img_proxy:
- Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- OriginalFileName:
- Cmd.Exe
- PowerShell.EXE
- pwsh.dll
selection_fsutil_cli:
CommandLine|contains|all:
- fsutil
- behavior
- set
- SymlinkEvaluation
selection_symlink_params:
CommandLine|contains:
- R2L:1
- R2R:1
- L2L:1
condition: all of selection_*
falsepositives:
- Legitimate usage, investigate the parent process and context to determine if benign.
level: medium
license: DRL-1.1
related:
- id: c0b2768a-dd06-4671-8339-b16ca8d1f27f
type: derived