CatalogLOLBAS

LOL · Binary

Fsutil.exe

3 techniquesWindowsLOLBASGPL-3.0

Tamper

Defense EvasionWindows

Zero out a file

Use Can be used to forensically erase a file

fsutil.exe file setZeroData offset=0 length=9999999999 {PATH_ABSOLUTE}
Evidence
Upstream reference
Environment
Local host
Context
user
Native
Tamper
MITRE
T1485
Detection
IOC: fsutil.exe should not be run on a normal workstation
IOC: file setZeroData (not case-sensitive) in the process arguments
IOC: Sysmon Event ID 1
IOC: Execution of process fsutil.exe with trace decode could be suspicious
IOC: Non-Windows netsh.exe execution

Tamper

Defense EvasionWindows

Delete the USN journal volume to hide file creation activity

Use Can be used to hide file creation activity

fsutil.exe usn deletejournal /d c:
Evidence
Upstream reference
Environment
Local host
Context
user
Native
Tamper
MITRE
T1485
Detection
IOC: fsutil.exe should not be run on a normal workstation
IOC: file setZeroData (not case-sensitive) in the process arguments
IOC: Sysmon Event ID 1
IOC: Execution of process fsutil.exe with trace decode could be suspicious
IOC: Non-Windows netsh.exe execution

Execute

ExecutionWindows

Executes a pre-planted binary named netsh.exe from the current directory.

Use Spawn a pre-planted executable from fsutil.exe.

fsutil.exe trace decode
Evidence
Upstream reference
Environment
Local host
Context
user
Native
Execute
MITRE
T1218
Detection
IOC: fsutil.exe should not be run on a normal workstation
IOC: file setZeroData (not case-sensitive) in the process arguments
IOC: Sysmon Event ID 1
IOC: Execution of process fsutil.exe with trace decode could be suspicious
IOC: Non-Windows netsh.exe execution