.. /Fsutil.exe
Star

Tamper
Execute (EXE)

File System Utility

Paths:

Resources:

Acknowledgements:

Detections:

Tamper

  1. Zero out a file

    fsutil.exe file setZeroData offset=0 length=9999999999 {PATH_ABSOLUTE}
    Use case

    Can be used to forensically erase a file

    Privileges required
    User
    Operating systems
    Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10
    ATT&CK® technique
    T1485

  2. Delete the USN journal volume to hide file creation activity

    fsutil.exe usn deletejournal /d c:
    Use case

    Can be used to hide file creation activity

    Privileges required
    User
    Operating systems
    Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10
    ATT&CK® technique
    T1485

  3. Instantly creates a new file of any specified size to exhaust free disk space.

    fsutil.exe file createnew {PATH_ABSOLUTE} {LENGTH_IN_BYTES}
    Use case

    Exhaust available disk space to impair defensive tools (preventing Windows Defender updates and halting local logging) or cause endpoint denial of service.

    Privileges required
    User
    Operating systems
    Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
    ATT&CK® technique
    T1562.001

Execute

  1. Executes a pre-planted binary named netsh.exe from the current directory.

    fsutil.exe trace decode
    Use case

    Spawn a pre-planted executable from fsutil.exe.

    Privileges required
    User
    Operating systems
    Windows 11
    ATT&CK® technique
    T1218
    Tags
    Execute: EXE