Fsutil Sets SymlinkEvaluation

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•16

This rule detects the execution of `fsutil.exe` with specific command-line arguments to set `SymlinkEvaluation`. This action can be used by adversaries, such as ransomware, to enable symbolic link following, potentially allowing them to access and encrypt files through shortcuts or junctions that would otherwise be inaccessible.