Skip to content
Threat Feed
Subscribe

Tag

Fsutil

4 briefs RSS
low advisory

Windows USN Journal Deletion via fsutil.exe

Adversaries may delete the USN journal on Windows systems using `fsutil.exe` to remove evidence of file modifications and other activities, hindering forensic investigations and incident response.

Windows defense-evasion anti-forensics fsutil
2r 1t
low advisory

Windows Peripheral Device Discovery via fsutil

Adversaries use the Windows file system utility `fsutil.exe` with the `fsinfo drives` argument to enumerate attached peripheral devices for reconnaissance and situational awareness after gaining initial access.

Windows discovery fsutil
2r 1t
low advisory

Windows USN Journal Deletion via Fsutil

Adversaries may delete the volume USN Journal on Windows systems using `fsutil.exe` to eliminate evidence of post-exploitation file activity.

Windows defense-evasion fsutil usn journal
2r 1t
low advisory

Windows Peripheral Device Discovery via fsutil

Adversaries may use the Windows file system utility, fsutil.exe, with the fsinfo drives command to enumerate attached peripheral devices and gain information about a compromised system.

Microsoft Defender XDR +1 discovery windows fsutil
2r 1t