Suspicious Fsutil.EXE Child Process

Nasreddine Bencherchali (Nextron Systems)

Detects child process of "fsutil.exe" starting from uncommon locations. Starting from Windows 11 the "fsutil.exe" utility introduced a commandline flag called "trace". It allows the user to start, stop, query and decode an NTFS trace information. Internally these sub flags will make use of the "netsh.exe" and "logman.exe" utilities to decode and handle the trace respectively. An attacker can plant a fake instance of "netsh.exe" or "logman.exe" in the current directory of execution and get them launched by "fsutil.exe".

2024-06-06 00:00:00

None

b325d28f-a2ac-483c-959c-f44403d0878c

attack.defense_evasion attack.impact attack.execution attack.t1070 attack.t1485

Nextron Sigma feed only (private)