Suspicious Usage of Fsutil for Anti-Forensics and Data Destruction

The Windows utility fsutil.exe is frequently abused by threat actors to perform anti-forensic activities and facilitate data destruction. Specifically, adversaries use the usn deletejournal command to clear the Update Sequence Number (USN) journal, effectively removing evidence of file system modifications. Other malicious techniques involve reconfiguring the journal with an extremely small size to cause rapid overwriting of logs or using setZeroData to instantly zero out critical files without manual deletion. These activities have been observed in multiple ransomware campaigns, including NotPetya and BlackByte, where they are used to hinder incident response efforts and complicate recovery by destroying the file system change history.

Impact

Successful execution of these commands allows attackers to erase audit trails and delete critical data without leaving the traditional file deletion markers that forensic tools monitor, leading to significant visibility gaps and potential data loss in targeted environments.

Recommendation

Detection engineering teams should implement monitoring for command-line arguments associated with fsutil maintenance commands.

• Enable Sysmon process-creation logging to capture CommandLine arguments for fsutil.exe.
• Deploy the Sigma rule below to detect unauthorized journal manipulation and file truncation attempts.
• Establish an alert baseline for administrators who perform legitimate storage maintenance to reduce false positives in the Security Operations Center.