detection.wiki

Detection rules › Sigma

Potentially Suspicious NTFS Symlink Behavior Modification

Status
test
Severity
medium
Log source
product windows, category process_creation
Author
frack113, The DFIR Report
Source
github.com/SigmaHQ/sigma

Detects the modification of NTFS symbolic link behavior using fsutil, which could be used to enable remote to local or remote to remote symlinks for potential attacks.

MITRE ATT&CK coverage

TacticTechniques
ExecutionT1059 Command and Scripting Interpreter
Defense ImpairmentT1222.001 File and Directory Permissions Modification: Windows Permissions

Event coverage

ProviderEventTitle
SysmonEvent ID 1Process creation

Rule body yaml

title: Potentially Suspicious NTFS Symlink Behavior Modification
id: c0b2768a-dd06-4671-8339-b16ca8d1f27f
status: test
description: |
    Detects the modification of NTFS symbolic link behavior using fsutil, which could be used to enable remote to local or remote to remote symlinks for potential attacks.
references:
    - https://www.cybereason.com/blog/cybereason-vs.-blackcat-ransomware
    - https://learn.microsoft.com/fr-fr/windows-server/administration/windows-commands/fsutil-behavior
    - https://thedfirreport.com/2025/06/30/hide-your-rdp-password-spray-leads-to-ransomhub-deployment/
author: frack113, The DFIR Report
date: 2022-03-02
modified: 2025-11-13
tags:
    - attack.execution
    - attack.defense-impairment
    - attack.t1059
    - attack.t1222.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_img_proxy:
        # Note: Example command observed:  cmd.exe /c "fsutil behaviour set SymlinkEvaluation"
        - Image|endswith:
              - '\cmd.exe'
              - '\powershell.exe'
              - '\pwsh.exe'
        - OriginalFileName:
              - 'Cmd.Exe'
              - 'PowerShell.EXE'
              - 'pwsh.dll'
    selection_fsutil_cli:
        CommandLine|contains|all:
            - 'fsutil'
            - 'behavior'
            - 'set'
            - 'SymlinkEvaluation'
    selection_symlink_params:
        CommandLine|contains:
            - 'R2L:1' # Remote to Local
            - 'R2R:1' # Remote to Remote
            - 'L2L:1' # Local to Local
    condition: all of selection_*
falsepositives:
    - Legitimate usage, investigate the parent process and context to determine if benign.
level: medium

Stages and Predicates

Stage 0: condition

all of selection_*

Stage 1: selection_img_proxy

selection_img_proxy:
    - Image|endswith:
          - '\cmd.exe'
          - '\powershell.exe'
          - '\pwsh.exe'
    - OriginalFileName:
          - 'Cmd.Exe'
          - 'PowerShell.EXE'
          - 'pwsh.dll'

Stage 2: selection_fsutil_cli

selection_fsutil_cli:
    CommandLine|contains|all:
        - 'fsutil'
        - 'behavior'
        - 'set'
        - 'SymlinkEvaluation'

Stage 3: selection_symlink_params

selection_symlink_params:
    CommandLine|contains:
        - 'R2L:1'
        - 'R2R:1'
        - 'L2L:1'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • L2L:1
  • R2L:1
  • R2R:1
  • SymlinkEvaluation corpus 2 (sigma 1, splunk 1)
  • behavior corpus 3 (sigma 2, splunk 1)
  • fsutil
  • set corpus 11 (sigma 10, splunk 1)
Imageends_with
  • \cmd.exe corpus 130 (sigma 130)
  • \powershell.exe corpus 182 (sigma 182)
  • \pwsh.exe corpus 168 (sigma 168)
OriginalFileNameeq
  • Cmd.Exe corpus 65 (sigma 43, splunk 17, elastic 5)
  • PowerShell.EXE corpus 120 (sigma 84, splunk 30, elastic 6)
  • pwsh.dll corpus 112 (sigma 79, splunk 30, elastic 3)