cscli scenarios install sigmahq/proc_creation_win_fsutil_usage1type: trigger2name: sigmahq/proc_creation_win_fsutil_usage3description: |4 Detects suspicious parameters of fsutil (deleting USN journal, configuring it with small size, etc). Might be used by ransomwares during the attack (seen by NotPetya and others).5filter: |6 (evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1') && ((evt.Parsed.Image endsWith '\\fsutil.exe' || evt.Parsed.OriginalFileName == 'fsutil.exe') && (evt.Parsed.CommandLine contains 'deletejournal' || evt.Parsed.CommandLine contains 'createjournal' || evt.Parsed.CommandLine contains 'setZeroData'))7blackhole: 2m8#status: stable9labels:10 service: windows11 confidence: 212 spoofable: 013 classification:14 - attack.t107015 - attack.t14851617 label: "Fsutil Suspicious Invocation"18 behavior : "windows:audit"19 remediation: false2021scope:22 type: ParentProcessId23 expression: evt.Parsed.ParentProcessId2425