Potentially Suspicious NTFS Symlink Behavior Modification

Status: test
Severity: medium
Log source: category process_creation, product windows
Author: frack113, The DFIR Report
Source: github.com/SigmaHQ/sigma

Detects the modification of NTFS symbolic link behavior using fsutil, which could be used to enable remote to local or remote to remote symlinks for potential attacks.

Known false positives

Legitimate usage, investigate the parent process and context to determine if benign.

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1059` Command and Scripting Interpreter
Defense Impairment	`T1222.001` File and Directory Permissions Modification: Windows Permissions

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Potentially Suspicious NTFS Symlink Behavior Modification
id: c0b2768a-dd06-4671-8339-b16ca8d1f27f
status: test
description: |
    Detects the modification of NTFS symbolic link behavior using fsutil, which could be used to enable remote to local or remote to remote symlinks for potential attacks.
references:
    - https://www.cybereason.com/blog/cybereason-vs.-blackcat-ransomware
    - https://learn.microsoft.com/fr-fr/windows-server/administration/windows-commands/fsutil-behavior
    - https://thedfirreport.com/2025/06/30/hide-your-rdp-password-spray-leads-to-ransomhub-deployment/
author: frack113, The DFIR Report
date: 2022-03-02
modified: 2025-11-13
tags:
    - attack.execution
    - attack.defense-impairment
    - attack.t1059
    - attack.t1222.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_img_proxy:
        # Note: Example command observed:  cmd.exe /c "fsutil behaviour set SymlinkEvaluation"
        - Image|endswith:
              - '\cmd.exe'
              - '\powershell.exe'
              - '\pwsh.exe'
        - OriginalFileName:
              - 'Cmd.Exe'
              - 'PowerShell.EXE'
              - 'pwsh.dll'
    selection_fsutil_cli:
        CommandLine|contains|all:
            - 'fsutil'
            - 'behavior'
            - 'set'
            - 'SymlinkEvaluation'
    selection_symlink_params:
        CommandLine|contains:
            - 'R2L:1' # Remote to Local
            - 'R2R:1' # Remote to Remote
            - 'L2L:1' # Local to Local
    condition: all of selection_*
falsepositives:
    - Legitimate usage, investigate the parent process and context to determine if benign.
level: medium

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_img_proxy`

selection_img_proxy:
    - Image|endswith:
          - '\cmd.exe'
          - '\powershell.exe'
          - '\pwsh.exe'
    - OriginalFileName:
          - 'Cmd.Exe'
          - 'PowerShell.EXE'
          - 'pwsh.dll'

Stage 2: `selection_fsutil_cli`

selection_fsutil_cli:
    CommandLine|contains|all:
        - 'fsutil'
        - 'behavior'
        - 'set'
        - 'SymlinkEvaluation'

Stage 3: `selection_symlink_params`

selection_symlink_params:
    CommandLine|contains:
        - 'R2L:1'
        - 'R2R:1'
        - 'L2L:1'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`L2L:1` `R2L:1` `R2R:1` `SymlinkEvaluation` corpus 2 (sigma 1, splunk 1) `behavior` corpus 3 (sigma 2, splunk 1) `fsutil` `set` corpus 11 (sigma 10, splunk 1)	`field:"CommandLine" kind:match`
`Image`	ends_with	`\cmd.exe` corpus 130 (sigma 130) `\powershell.exe` corpus 179 (sigma 178, kusto 1) `\pwsh.exe` corpus 165 (sigma 164, kusto 1)	`field:"Image" kind:ends_with`
`OriginalFileName`	eq	`Cmd.Exe` corpus 81 (sigma 43, elastic 21, splunk 17) `PowerShell.EXE` corpus 138 (sigma 84, splunk 30, elastic 24) `pwsh.dll` corpus 112 (sigma 79, splunk 30, elastic 3)	`field:"OriginalFileName" kind:eq`