Windows System Log: NTFS File System Driver Event 55 Indicates Possible NTFS Exploitation
Alerts on Windows NTFS Event ID 55 indicating a corrupted file record with a matching filename string in the event description.
- Product
- windows
- Service
- system
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2021-01-11
- Updated
- 2026-07-31
ATT&CK techniques
ImpactRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
What it detects
This rule flags Windows System events where the NTFS file system driver reports EventID 55 with a message indicating a corrupted file record. Attackers may exploit NTFS parsing or integrity weaknesses to cause unexpected file-system behavior, corruption, or persistence effects. The detection relies on Windows System log telemetry fields such as Provider_Name, EventID, Origin, and the event description text containing specific corruption indicators.
Reporting behind it
- twitter.comhttps://twitter.com/jonasLyk/status/1347900440000811010
- twitter.comhttps://twitter.com/wdormann/status/1347958161609809921
- bleepingcomputer.comhttps://www.bleepingcomputer.com/news/security/windows-10-bug-corrupts-your-hard-drive-on-seeing-this-files-icon/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/ntfs/win_system_ntfs_vuln_exploit.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows System Log: NTFS File System Driver Event 55 Indicates Possible NTFS Exploitation"
id: 72f5aea6-f426-4c2f-a172-21923fe12396
status: test
description: This rule flags Windows System events where the NTFS file system driver reports EventID 55 with a message indicating a corrupted file record. Attackers may exploit NTFS parsing or integrity weaknesses to cause unexpected file-system behavior, corruption, or persistence effects. The detection relies on Windows System log telemetry fields such as Provider_Name, EventID, Origin, and the event description text containing specific corruption indicators.
references:
- https://twitter.com/jonasLyk/status/1347900440000811010
- https://twitter.com/wdormann/status/1347958161609809921
- https://www.bleepingcomputer.com/news/security/windows-10-bug-corrupts-your-hard-drive-on-seeing-this-files-icon/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/ntfs/win_system_ntfs_vuln_exploit.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-01-11
modified: 2022-12-25
tags:
- attack.impact
- attack.t1499.001
logsource:
product: windows
service: system
detection:
selection:
Provider_Name: Ntfs
EventID: 55
Origin: File System Driver
Description|contains|all:
- contains a corrupted file record
- The name of the file is "\"
condition: selection
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: f14719ce-d3ab-4e25-9ce6-2899092260b0
type: derived