Fsutil Drive Enumeration
This rule detects the execution of 'fsutil.exe' with the 'drives' command-line argument. This command is used to enumerate connected drives on a Windows system. Adversaries, such as Turla, have been observed using this technique for discovery purposes to gain information about the system's environment.
Sigma
