Fsutil Suspicious Invocation

SigmaHQ Detections@sigmaHQ

•updated Sep 9, 2023•0•0•0

Detects suspicious parameters of fsutil (deleting USN journal, configuring it with small size, etc). Might be used by ransomwares during the attack (seen by NotPetya and others).