Rule Info
Name
Free Disk Space Enumeration Via Fsutil
Author
Swachchhanda Shrawan Poudel (Nextron Systems)
Description
Detects the use of fsutil to enumerate free disk space on a volume.
Threat actors may abuse this to determine available space before carrying out further actions such as data destruction or exfiltration.
Date
2026-05-04 00:00:00
Modified
None
Id
95ecf4cb-e11b-4254-afff-b88e89ffd40c
Tags
attack.discovery attack.t1082
Type
Nextron Sigma feed only (private)
Rule History
Scan your endpoints, forensic images or collected files with our portable scanner THOR