Ceplin Command Identifier

Identifier / Programs / Windows

fsutil.exe

Performs tasks related to FAT and NTFS file systems, such as managing reparse points, handling sparse files, or dismounting a volume. Windows commands reference

LOLBAS Tamper, Execute 4 Sigma rules name it 4 ATT&CK techniques 4 documented commands 12 known copies with hashes

Opens the identifier with your command. It is read in your browser and sent nowhere.

How fsutil.exe is abused

documented by LOLBAS

Tamper T1485 Data Destruction

file setzerodata

Tamper T1485 Data Destruction

usn deletejournal

/dDisables an active USN change journal, and returns input/output (I/O) control while the change journal is being disabled. Windows commands reference

Execute T1218 System Binary Proxy Execution

trace decode

Tamper T1562.001

file createnew

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for fsutil.exe.

4 documented commands

from LOLBAS, each read by the identifier

Tamper T1485 Data Destruction User privileges

Zero out a file

fsutil.exe file setZeroData offset=0 length=9999999999 {PATH_ABSOLUTE}
Identify

Trips 1 Sigma rule: highFsutil Suspicious Invocation by Ecco, E.M. Anhaus, oscd.community

Tamper T1485 Data Destruction User privileges

Delete the USN journal volume to hide file creation activity

fsutil.exe usn deletejournal /d c:
Identify

Trips 1 Sigma rule: highFsutil Suspicious Invocation by Ecco, E.M. Anhaus, oscd.community

Execute T1218 System Binary Proxy Execution User privileges

Executes a pre-planted binary named netsh.exe from the current directory.

fsutil.exe trace decode
Identify

Trips no Sigma process-creation rule.

Tamper T1562.001 User privileges

Instantly creates a new file of any specified size to exhaust free disk space.

fsutil.exe file createnew {PATH_ABSOLUTE} {LENGTH_IN_BYTES}
Identify

Trips no Sigma process-creation rule.

2 of the 4 commands the identifier reads trip a Sigma process-creation rule; 2 trip none. These commands and their descriptions are from LOLBAS’s entry for fsutil.exe, by Elliot Killick, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for fsutil.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules
highFsutil Suspicious InvocationEcco, E.M. Anhaus, oscd.community
lowFsutil Drive EnumerationChristopher Peacock '@securepeacock', SCYTHE '@scythe_io'
highSuspicious Spool Service Child ProcessJustin C. (@endisphotic), @dreadphones (detection), Thomas Patzke (Sigma rule)
highWebshell Hacking Activity PatternsFlorian Roth (Nextron Systems)
T1070Indicator Removal
T1120Peripheral Device Discovery
T1218System Binary Proxy Execution
T1485Data Destruction

Is it the real fsutil.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
Descriptionfsutil.exe

12 known copies

10.0.22000.282 (WinBuild.160101.0800) · C:\WINDOWS\system32\fsutil.exe · signed by Microsoft Windows

aba8e2851e4562878e760b8599e2b4b8e5965d9130dc7a9402ca5d1bad00581c

10.0.22000.282 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\fsutil.exe · signed by Microsoft Windows

b9fe14610c16fb1b1a6f23a6b5cdffcb6caf8294177ffd78eb505deed6443386

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\fsutil.exe · signed by Microsoft Windows

8767bc230a6928df40b66a1d127c7dbaedf70bd18d5c20c094ffc7f23902a7cf

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\fsutil.exe · signed by Microsoft Windows

b732e4e29a2d768417bbcd1b18368b1ba9bfecf0eb4af320c27b5d800d1f8da2

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\fsutil.exe · signed by Microsoft Windows

663176115ad56014efc43b792aead9658c3d1045cc64fe794c3ef9d4105a8f3a

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\fsutil.exe · signed by Microsoft Windows

e9d78e39bfd9395798cc85c583ad15b0b107e17f81f3ec24b5f1bbf4ace92e14

10.0.17763.652 (WinBuild.160101.0800) · C:\Windows\SysWOW64\fsutil.exe · signed by Microsoft Windows

3b13a67dd25962bb50ab60aca722b0aec4810c9c23f2f8d6e3648ad6d694b194

10.0.17763.652 (WinBuild.160101.0800) · C:\Windows\system32\fsutil.exe · signed by Microsoft Windows

c302730b6088c6e28d1d9692d4d7d512c622979e58a1f6ccec396ac1231f3de2

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\fsutil.exe · signed by Microsoft Windows

66a36effc1ccac37a95ed1d268c1e5f92f47707f8e0c8039c2bd8c954c5f4100

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\fsutil.exe · signed by Microsoft Windows

ec750391d52bba76bb5bbb2ff6fd53eef03b043bc48da72bac0b9c07cd0241be

6.3.9600.17031 (winblue_gdr.140221-1952) · C:\windows\system32\fsutil.exe · not signed

1a988d562a72325c0e97e4be05fb311e052e12a095387754fed02b446b032a1a

6.3.9600.17031 (winblue_gdr.140221-1952) · C:\windows\SysWOW64\fsutil.exe · not signed

4c948318b04dadb58926818d02776129b651a134e01e28d7b6707994a83a0227

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

Everyday use

from tldr-pages, CC BY 4.0

Display a list of volumes

fsutil volume listIdentify

Display information about a volume's filesystem

fsutil fsInfo volumeInfo drive_letterIdentify

Display the current state of the filesystem auto-repair for all volumes

fsutil repair stateIdentify

None of the 3 examples the identifier reads matches LOLBAS abuse or trips a Sigma process-creation rule.

Other programs abused for Tamper

cipher.exe · fltmc.exe · vssadmin.exe