Fsutil Suspicious Invocation

Title: Fsutil Suspicious Invocation
Status: stable
Description:Detects suspicious parameters of fsutil (deleting USN journal, configuring it with small size, etc). Might be used by ransomwares during the attack (seen by NotPetya and others).
References:
  -https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-usn
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070/T1070.md
  -https://eqllib.readthedocs.io/en/latest/analytics/c91f422a-5214-4b17-8664-c5fcf115c0a2.html
  -https://github.com/albertzsigovits/malware-notes/blob/558898932c1579ff589290092a2c8febefc3a4c9/Ransomware/Lockbit.md
  -https://blog.cluster25.duskrise.com/2023/05/22/back-in-black-blackbyte-nt
Author: Ecco, E.M. Anhaus, oscd.community
Date: 2019-09-26
modified:2023-09-09
Tags:

• -'attack.impact'
• -'attack.stealth'
• -'attack.t1070'
• -'attack.t1485'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\fsutil.exe' OriginalFileName:'fsutil.exe'   selection_cli:
    CommandLine|contains:
      -'deletejournal'
      -'createjournal'
      -'setZeroData'

  condition:all of selection_*
Falsepositives:
  -Admin activity
  -Scripts and administrative tools used in the monitored environment
Level: high