Usecase: Can be used to forensically erase a file
Privileges required: User
OS: Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10
MITRE ATT&CK®: T1485
Delete the USN journal volume to hide file creation activity
fsutil.exe usn deletejournal /d c:
Usecase: Can be used to hide file creation activity
Privileges required: User
OS: Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10
MITRE ATT&CK®: T1485
Execute
Executes a pre-planted binary named netsh.exe from the current directory.
fsutil.exe trace decode
Usecase: Spawn a pre-planted executable from fsutil.exe.
Privileges required: User
OS: Windows 11
MITRE ATT&CK®: T1218