Fsutil Drive Enumeration

Title: Fsutil Drive Enumeration
Status: test
Description:Attackers may leverage fsutil to enumerated connected drives.
References:
  -Turla has used fsutil fsinfo drives to list connected drives.
  -https://github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/discovery_peripheral_device.toml
Author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io'
Date: 2022-03-29
modified:2022-07-14
Tags:

• -'attack.discovery'
• -'attack.t1120'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\fsutil.exe' OriginalFileName:'fsutil.exe'   selection_cli:
    CommandLine|contains: 'drives'
  condition:all of selection_*
Falsepositives:
  -Certain software or administrative tasks may trigger false positives.
Level: low