Filesystem management utility
fsutil trace decode
Executes a pre-planted binary named netsh.exe from the current directory.
Spawn a pre-planted executable from fsutil.exe.
C:\Windows\System32\fsutil.exe
IOC: Sysmon Event ID 1, IOC: Execution of process fsutil.exe with trace decode could be suspicious, IOC: Non-Windows netsh.exe execution
Grzegorz Tworek (@0gtweet)