Potentially Suspicious NTFS Symlink Behavior Modification

Title: Potentially Suspicious NTFS Symlink Behavior Modification
Status: test
Description:Detects the modification of NTFS symbolic link behavior using fsutil, which could be used to enable remote to local or remote to remote symlinks for potential attacks.
References:
  -https://www.cybereason.com/blog/cybereason-vs.-blackcat-ransomware
  -https://learn.microsoft.com/fr-fr/windows-server/administration/windows-commands/fsutil-behavior
  -https://thedfirreport.com/2025/06/30/hide-your-rdp-password-spray-leads-to-ransomhub-deployment/
Author: frack113, The DFIR Report
Date: 2022-03-02
modified:2025-11-13
Tags:

• -'attack.execution'
• -'attack.defense-impairment'
• -'attack.t1059'
• -'attack.t1222.001'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img_proxy:
    - Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
    - OriginalFileName:
      - 'Cmd.Exe'
      - 'PowerShell.EXE'
      - 'pwsh.dll'
  selection_fsutil_cli:
    CommandLine|contains|all:
      -'fsutil'
      -'behavior'
      -'set'
      -'SymlinkEvaluation'

  selection_symlink_params:
    CommandLine|contains:
      -'R2L:1'
      -'R2R:1'
      -'L2L:1'

  condition:all of selection_*
Falsepositives:
  -Legitimate usage, investigate the parent process and context to determine if benign.
Level: medium