Windows: NotPetya indicators via wevtutil log clearing, fsutil deletejournal, and rundll32 .dat/.zip.dll execution
Flags Windows process execution indicative of NotPetya: clearing event logs with wevtutil and deleting C drive USN journal with fsutil.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems), Tom Ueltschi (SigmaHQ), DRL 1.1
- Published
- 2019-01-16
- Updated
- 2026-07-31
ATT&CK techniques
Defense Evasion → Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule matches process creation commands consistent with NotPetya ransomware behavior, including clearing Windows event logs with wevtutil and deleting the NTFS journal on drive C using fsutil. It also looks for rundll32.exe execution patterns that reference extracted payload data (e.g., .dat or .zip.dll) and a perfc-related marker file. These actions matter to attackers because they impair forensic visibility and support credential theft and malware execution; the rule relies on Windows process creation telemetry capturing image paths and command-line arguments.
Reporting behind it
- securelist.comhttps://securelist.com/schroedingers-petya/78870/
- hybrid-analysis.comhttps://www.hybrid-analysis.com/sample/64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1?environmentId=100
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2017/Malware/NotPetya/proc_creation_win_malware_notpetya.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: NotPetya indicators via wevtutil log clearing, fsutil deletejournal, and rundll32 .dat/.zip.dll execution"
id: 0333b420-966f-488d-95a1-b0be0c57749d
status: test
description: This rule matches process creation commands consistent with NotPetya ransomware behavior, including clearing Windows event logs with wevtutil and deleting the NTFS journal on drive C using fsutil. It also looks for rundll32.exe execution patterns that reference extracted payload data (e.g., .dat or .zip.dll) and a perfc-related marker file. These actions matter to attackers because they impair forensic visibility and support credential theft and malware execution; the rule relies on Windows process creation telemetry capturing image paths and command-line arguments.
references:
- https://securelist.com/schroedingers-petya/78870/
- https://www.hybrid-analysis.com/sample/64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1?environmentId=100
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2017/Malware/NotPetya/proc_creation_win_malware_notpetya.yml
author: Florian Roth (Nextron Systems), Tom Ueltschi, Huntrule Team
date: 2019-01-16
modified: 2022-12-15
tags:
- attack.stealth
- attack.defense-impairment
- attack.t1218.011
- attack.t1685.005
- attack.credential-access
- attack.t1003.001
- car.2016-04-002
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection_specific_pattern:
CommandLine|contains:
- "wevtutil cl Application & fsutil usn deletejournal /D C:"
- dllhost.dat %WINDIR%\ransoms
selection_rundll32:
Image|endswith: \rundll32.exe
CommandLine|endswith:
- .dat,#1
- ".dat #1"
- .zip.dll",#1
selection_perfc_keyword:
- \perfc.dat
condition: 1 of selection_*
falsepositives:
- Unknown
level: critical
license: DRL-1.1
related:
- id: 79aeeb41-8156-4fac-a0cd-076495ab82a1
type: derived