Potentially Suspicious NTFS Symlink Behavior Modification

SigmaHQ Detections@sigmaHQ

•updated Nov 13, 2025•0•0•0

Detects the modification of NTFS symbolic link behavior using fsutil, which could be used to enable remote to local or remote to remote symlinks for potential attacks.