.. /Fsutil.exe
Star

File System Utility


Paths:

Resources:
Acknowledgements:

Detection:

Tamper

Zero out a file 
fsutil.exe file setZeroData offset=0 length=9999999999 C:\Windows\Temp\payload.dll
Usecase: Can be used to forensically erase a file
Privileges required: User
OS: Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10
MITRE ATT&CK®: T1485



Delete the USN journal volume to hide file creation activity 
fsutil.exe usn deletejournal /d c:
Usecase: Can be used to hide file creation activity
Privileges required: User
OS: Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10
MITRE ATT&CK®: T1485



Execute

Executes a pre-planted binary named netsh.exe from the current directory. 
fsutil.exe trace decode
Usecase: Spawn a pre-planted executable from fsutil.exe.
Privileges required: User
OS: Windows 11
MITRE ATT&CK®: T1218