Fsutil.exe

File System Utility

Execute

Spawn a pre-planted executable from fsutil.exe.

fsutil.exe trace decode

Executes a pre-planted binary named netsh.exe from the current directory. — MITRE: T1218 — Privileges: User

Tamper

Can be used to forensically erase a file

fsutil.exe file setZeroData offset=0 length=9999999999 {PATH_ABSOLUTE}

Zero out a file — MITRE: T1485 — Privileges: User

Can be used to hide file creation activity

fsutil.exe usn deletejournal /d c:

Delete the USN journal volume to hide file creation activity — MITRE: T1485 — Privileges: User