.. /Fsutil.exe
Star

Tamper
Execute (EXE)

File System Utility

Paths:

Resources:

Acknowledgements:

Detections:

Tamper

  1. Zero out a file

    fsutil.exe file setZeroData offset=0 length=9999999999 {PATH_ABSOLUTE}
    Use case

    Can be used to forensically erase a file

    Privileges required
    User
    Operating systems
    Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10
    ATT&CK® technique
    T1485

  2. Delete the USN journal volume to hide file creation activity

    fsutil.exe usn deletejournal /d c:
    Use case

    Can be used to hide file creation activity

    Privileges required
    User
    Operating systems
    Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10
    ATT&CK® technique
    T1485

Execute

  1. Executes a pre-planted binary named netsh.exe from the current directory.

    fsutil.exe trace decode
    Use case

    Spawn a pre-planted executable from fsutil.exe.

    Privileges required
    User
    Operating systems
    Windows 11
    ATT&CK® technique
    T1218
    Tags
    Execute: EXE