{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/forensics-tampering/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["medium"],"_cs_tags":["defense-evasion","windows","forensics-tampering"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThis threat brief focuses on the detection of the Windows Update Sequence Number (USN) Journal deletion, a technique frequently employed by threat actors to obfuscate malicious activity. The USN Journal is a critical NTFS feature that records changes made to files on a disk volume. By using the built-in Windows utility 'fsutil.exe' to delete the journal, attackers can effectively wipe historical file-modification logs, thereby complicating forensic analysis and incident response. This behavior is commonly associated with ransomware operations and general log manipulation tactics aimed at defense evasion. Detecting this activity is vital for identifying attackers attempting to cover their tracks during the post-exploitation phase of an intrusion.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker gains administrative or SYSTEM-level access to a Windows endpoint.\u003c/li\u003e\n\u003cli\u003eThe attacker identifies the need to clear forensic artifacts from the system.\u003c/li\u003e\n\u003cli\u003eThe attacker opens a command shell (e.g., cmd.exe or PowerShell) with elevated privileges.\u003c/li\u003e\n\u003cli\u003eThe attacker executes the 'fsutil' binary with the 'usn' and 'deletejournal' arguments against a target volume.\u003c/li\u003e\n\u003cli\u003eThe Windows system processes the command, causing the NTFS driver to purge the USN Journal data.\u003c/li\u003e\n\u003cli\u003eThe USN Journal is effectively deleted or reset, removing records of recent file system activity.\u003c/li\u003e\n\u003cli\u003eThe attacker proceeds with additional malicious operations, such as data exfiltration or ransomware deployment, with a reduced footprint.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful deletion of the USN Journal hinders the ability of security teams to perform accurate forensic reconstructions. This action prevents investigators from identifying the scope of file modifications, detecting unauthorized file access, or mapping the timeline of attacker activity. This technique is observed across various intrusion scenarios, particularly in ransomware campaigns where attackers aim to slow down detection and remediation efforts.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the Sigma rule provided below to your SIEM to monitor for 'fsutil.exe' command-line execution targeting the USN journal.\u003c/li\u003e\n\u003cli\u003eEnable Sysmon Event ID 1 (Process Creation) to capture detailed command-line arguments, which is critical for identifying the 'deletejournal' flag.\u003c/li\u003e\n\u003cli\u003eMonitor for any use of 'fsutil.exe' in an administrative context, as this utility is rarely used by standard system processes or typical users in a production environment.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T18:00:21Z","date_published":"2026-10-12T18:00:21Z","id":"https://feed.craftedsignal.io/briefs/2026-10-usn-journal-deletion/","summary":"Detection of the deletion of the Windows Update Sequence Number (USN) Journal using the fsutil.exe utility to identify attempts by adversaries to hinder forensic investigations.","title":"Detection of USN Journal Deletion via FSUtil","url":"https://feed.craftedsignal.io/briefs/2026-10-usn-journal-deletion/"}],"language":"en","title":"CraftedSignal Threat Feed - Forensics-Tampering","version":"https://jsonfeed.org/version/1.1"}