Phoenix
Sigma IntelligenceBeta
Back to Rules
Detectionlowtest

Fsutil Drive Enumeration

Attackers may leverage fsutil to enumerated connected drives.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Christopher Peacock, SCYTHECreated Tue Mar 29Updated Thu Jul 1463de06b9-a385-40b5-8b32-73f2b9ef84b6windows
Log Source
WindowsProcess Creation
ProductWindows← raw: windows
CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic
Detection Logic2 selectors
detection:
    selection_img:
        - Image|endswith: '\fsutil.exe'
        - OriginalFileName: 'fsutil.exe'
    selection_cli:
        CommandLine|contains: 'drives'
    condition: all of selection_*
False Positives

Certain software or administrative tasks may trigger false positives.

References
1
Resolving title…
Turla has used fsutil fsinfo drives to list connected drives.
2
Resolving title…
github.com
MITRE ATT&CK
Rule Metadata
Rule ID
63de06b9-a385-40b5-8b32-73f2b9ef84b6
Status
test
Level
low
Type
Detection
Created
Tue Mar 29
Modified
Thu Jul 14
Author
Christopher Peacock, SCYTHE
Path
rules/windows/process_creation/proc_creation_win_fsutil_drive_enumeration.yml
Raw Tags
attack.discoveryattack.t1120
View on GitHub